Netform GmbH Listed by 8base Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations by claiming to have stolen data and then listing victims on public leak sites, a tactic that has become a routine feature of the current cyber-threat landscape. In mid-January 2025, the group known as 8base added Netform GmbH, a German software-development firm, to its listings, asserting that it had exfiltrated internal files during a ransomware attack. Public detail remains limited, yet the claim itself is enough to raise practical concerns for anyone whose information may have been held by the company.

Because the number of people affected and the precise contents of the stolen material have not been confirmed, the incident sits in the common grey zone of modern ransomware reporting: a public accusation without independent verification. Understanding what is known, what is claimed, and what organisations of this type typically hold is the most useful way for affected individuals and partners to assess risk.

What happened

On 16 January 2025 it was reported that Netform GmbH had been listed by the 8base ransomware group. According to the available summary, the group claims that internal files were exfiltrated in a ransomware attack. No further technical details—such as the initial access method, the exact date of intrusion, the volume of data taken, or any ransom demand—have been disclosed in the public record. The number of people affected is listed as unknown. The listing itself constitutes an unverified claim by the threat actor; independent confirmation that a breach occurred, or that the claimed files match what 8base asserts, has not been provided in the facts available.

Inside 8base

8base is a ransomware operation that has been active for several years and is documented for practising double extortion: encrypting systems while also stealing data and threatening to publish it if a ransom is not paid. The group maintains a leak site where it posts the names of organisations it claims to have compromised, often accompanied by sample files or countdown timers. Public reporting on 8base has described a focus on mid-sized businesses across multiple sectors and geographies, with tactics that typically include phishing, exploitation of remote-access services, and the use of commodity ransomware tooling. These patterns are drawn from well-established public knowledge of the group’s prior activity; they do not constitute Reported Details of the Netform incident. In this case, 8base’s listing of Netform GmbH should be treated strictly as the group’s claim rather than as independently verified fact.

Who is Netform GmbH?

Netform GmbH is a software-development company founded in 2002 and headquartered at Carl-Von-Linde-Straße 10, 65197 Wiesbaden, Germany. The firm specialises in custom software development tailored to the individual needs of its customers. Organisations of this kind commonly handle source code, project documentation, client correspondence, contracts, and internal operational records. Because software developers often work with sensitive business logic and customer data, a breach claim involving such a firm carries potential consequences for both the company’s own staff and its clients. The public website associated with the company is net-inform.de. No additional corporate details beyond those stated in the breach record are required to understand why the listing matters.

What was likely exposed

The facts name the exposed material as “internal files exfiltrated in ransomware attack.” No more granular inventory—such as employee records, customer databases, source-code repositories, or financial documents—has been disclosed. Software-development firms of Netform’s profile typically hold source code, design documents, client project files, email archives, and administrative records that may contain personal or commercial information. Because the exact contents remain unconfirmed, it is not possible to state with certainty which categories of data, if any, were taken. The claim of internal-file exfiltration is therefore the only concrete assertion available; everything beyond that is unconfirmed.

The real-world impact

For individuals whose data may have been among the internal files, the principal risks are identity-related misuse, targeted phishing that leverages stolen context, and the longer-term exposure of personal or professional details if the material is later published or sold. For Netform GmbH itself, the listing can affect client trust, contractual obligations, and regulatory scrutiny under European data-protection rules, even while the full scope of the incident stays unknown. Because the number of people affected is listed as unknown and no confirmation of publication has been reported, the practical impact remains potential rather than fully measured. Organisations and individuals connected to Netform should treat the claim seriously without assuming the worst-case scenario has already materialised.

What to do if you're exposed

Anyone who has done business with Netform GmbH, or who suspects their information may have been held by the company, should take a small set of practical steps. Monitor financial and email accounts for unusual activity, enable multi-factor authentication wherever it is available, and be alert to phishing messages that reference software projects or German business contacts. Consider changing passwords on accounts that may have been reused across services. If you believe personal data was involved, you may also wish to place fraud alerts with relevant credit agencies according to local procedures. Finally, readers can run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a scan provides an independent, low-effort way to gauge whether personal information has surfaced elsewhere.

AICompiled with AI assistance from public sources and published under our editorial standards.