Omnitravel Listed by 8base Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 7 January 2025, the Belgian travel company Omnitravel appeared on a leak site operated by the 8base ransomware group. The group claims that internal files were exfiltrated during a ransomware attack. Public reporting so far gives no confirmed figure for the number of people affected, and further technical details of the incident remain limited.

The listing itself is an unverified claim by the threat actor. For customers, partners and staff who have dealt with Omnitravel over its more than 25 years of operation, the episode raises practical questions about what information may have been taken and what steps to take next.

Breaking down the breach

According to available public information, Omnitravel was listed by 8base on or around 7 January 2025. The group asserts that it carried out a ransomware attack and exfiltrated internal files. No independent confirmation of the attack’s success, the volume of data removed, or the precise date of intrusion has been published. The number of individuals potentially affected is listed as unknown. Method of initial access, encryption status of systems, and any ransom demand are likewise undisclosed in the public record.

What is known is confined to the leak-site claim and the organisation’s own public description of its business. Until Omnitravel or investigating authorities release further verified information, the scale and full technical character of the incident cannot be stated with certainty.

Inside 8base

8base is a ransomware operation that has been active in public view since roughly 2022–2023. Like many contemporary groups, it typically follows a double-extortion model: systems are encrypted and data is copied out; the threat of public release is then used to pressure victims. The group maintains a dedicated leak site on which it posts names of organisations it claims to have compromised, sometimes accompanied by sample files or countdown timers. 8base has been observed targeting a range of sectors and geographies rather than specialising in a single industry.

Public reporting on 8base’s tactics generally describes the use of common initial-access methods—phishing, exploitation of unpatched remote-access services, or compromised credentials—followed by lateral movement and data staging before encryption. The group has previously listed companies of varying sizes; each listing remains a claim until corroborated by the victim or forensic evidence. In the present case, the only assertion tied specifically to Omnitravel is the leak-site entry itself.

Omnitravel and its sector

Omnitravel is a travel company based in Belgium that has operated for more than 25 years. It provides vacations, business trips and group tours, emphasising personalised service and ongoing contact with clients before, during and after travel. Travel agencies and tour operators routinely handle booking records, identity documents, payment details, itineraries, emergency contacts and correspondence. Even when systems are not customer-facing portals, internal files can contain precisely this mixture of personal and commercial data.

A breach affecting a long-established travel firm is consequential because the data often remains useful for years: passport numbers, frequent-flyer details, corporate travel patterns and family contact information can all be reused in fraud or social-engineering schemes. The sector’s reliance on third-party booking platforms and seasonal staff further expands the potential attack surface, though no specific vector has been confirmed in this incident.

What data was at risk

The sole description available is that “internal files” were allegedly exfiltrated in a ransomware attack. No inventory of file types, databases or record counts has been published. Organisations of Omnitravel’s type typically store customer names, addresses, dates of birth, passport or identity-document scans, payment-card or bank details, travel itineraries, insurance information, and internal staff or supplier records. Whether any of these categories were among the files claimed by 8base is unconfirmed.

Because the exact contents remain undisclosed, it is not possible to state with certainty which data elements, if any, left the organisation’s control. Affected individuals should treat the possibility of personal and travel-related data exposure as open until official clarification is provided.

What's at stake

For people whose information may have been taken, the concrete risks include identity theft, fraudulent bookings or account takeovers, phishing that references real travel plans, and longer-term misuse of passport or financial data. Even partial records can enable convincing social-engineering attempts against the individual or their family and colleagues. For Omnitravel the stakes include operational disruption, regulatory notification obligations under European data-protection rules, potential contractual liabilities to corporate clients, and erosion of the trust that a personalised travel service depends upon.

Neither the financial cost of the incident nor any confirmed impact on customers has been made public. The absence of a disclosed victim count means the breadth of personal exposure cannot yet be measured.

What to do if you're exposed

If you have booked travel, held an account, or otherwise shared personal details with Omnitravel, begin by monitoring bank and credit-card statements for unfamiliar charges and enabling transaction alerts. Change passwords on any accounts that reused credentials associated with the company, and enable multi-factor authentication wherever available. Consider placing a fraud alert or credit freeze with the relevant Belgian or national credit bureaux if identity documents may have been involved. Watch for phishing messages that reference past trips or personal details; treat unsolicited requests for further information with caution.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Remain attentive to any official statements from Omnitravel or data-protection authorities, as further verified details may emerge.

AICompiled with AI assistance from public sources and published under our editorial standards.