Onsupport Corporation Listed by 8base Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 19 June 2023, Onsupport Corporation appeared on a leak site operated by the ransomware group known as 8base. Public detail is limited: the number of people affected is unknown, and the only description of what was taken is that internal files were allegedly exfiltrated in a ransomware attack. For clients, employees, and partners of an IT services firm, that claim alone is enough to raise practical questions about whether business records, credentials, or personal information could be at risk.

Because Onsupport helps small and mid-sized companies run networks, hosting, and applications, any exposure of its internal files could reach beyond the company itself. What follows is what is known, what remains unconfirmed, and what people who may be connected to the firm can usefully do next.

Inside the incident

According to reporting dated 19 June 2023, Onsupport Corporation was listed by the 8base ransomware group. The group claims that internal files were exfiltrated in a ransomware attack. No public figure has been given for how many people were affected. The precise date of any intrusion, the technical method used, the volume of data, and whether systems were encrypted or only copied have not been disclosed in the available record.

The listing itself is a claim by the threat actor. Independent confirmation of the full scope of the incident has not been provided in the facts at hand. Organisations named on ransomware leak sites sometimes negotiate, sometimes dispute the claims, and sometimes confirm only partial details later; none of those outcomes is established here.

Who is 8base?

8base is a ransomware operation that became more visible in public reporting in 2022 and 2023. Like many groups in that period, it has been associated with double-extortion tactics: encrypting systems where possible and also copying data, then threatening to publish the material on a dedicated leak site if a ransom is not paid. The group has typically posted victim names, sometimes with sample files or descriptions of stolen data, to increase pressure.

Public analyses have described 8base as focusing on a range of mid-sized organisations rather than only the largest enterprises. Its leak-site posts are marketing and coercion tools for the attackers; they should be read as claims unless corroborated. Nothing in the available facts attributes specific additional statements by 8base about Onsupport beyond the listing and the assertion that internal files were taken.

About Onsupport Corporation

Onsupport Corporation describes itself as an IT solutions provider operating since 1992. It works with clients to plan technology needs and offers managed network services, hosting services, and application and web development. Its stated focus is small and mid-sized companies, helping them run networks or use hosted virtual environments so they can concentrate on their own operations. The firm presents itself as a team of industry professionals supporting day-to-day technology management.

Firms in this sector routinely hold administrative access, configuration data, credentials, support tickets, and business contact information belonging to their customers. A breach at a managed-service or hosting provider is consequential because the provider sits in the middle of many other organisations’ infrastructure. Even when only the provider’s own internal files are described as taken, those files can contain material that identifies or affects clients.

The information in question

The available record names the exposed material only as internal files exfiltrated in a ransomware attack. No inventory of file types, no count of records, and no confirmation of personal data categories have been published in the facts provided. Exact contents therefore remain unconfirmed.

Organisations that deliver managed networks, hosting, and custom applications typically store items such as customer contact lists, contracts, internal correspondence, system documentation, credentials or password vaults used for support, billing records, and employee information. Whether any of those categories were present in the files 8base claims to hold is not established. Readers should treat specific data types as unknown until Onsupport or a trusted authority provides a clearer accounting.

The real-world impact

For individuals, the main risks from an unconfirmed internal-file exposure at an IT provider are secondary: phishing that references real client or employee details, password reuse attacks if any credentials were stored, and fraud that exploits knowledge of business relationships. Without a published list of affected people or data fields, no one can yet say with certainty who is in scope.

For Onsupport, the consequences include operational disruption if systems were locked, reputational harm from the public listing, possible contractual notice obligations to clients, and the cost of investigation and remediation. For Onsupport’s customers, the worry is whether their environments, backups, or support credentials were among the internal material. Those risks are real in principle for any managed-service breach; they are not quantified here because scale and content remain undisclosed.

If your data was in this claimed breach

If you are a client, employee, or partner of Onsupport Corporation, treat the situation as a prompt to tighten ordinary defences rather than as proof that your personal file was taken. Practical first steps include:

• Change passwords for any accounts that may have been used with or stored by the provider, and enable multi-factor authentication where it is available.
• Watch for unexpected invoices, password-reset messages, or support requests that reference Onsupport or your company; verify them through a known channel before responding.
• Review bank and credit activity if you have shared financial or identity details in the course of business with the firm.
• Ask Onsupport, through official contact routes, whether it has issued notices or guidance specific to this incident.
• Run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets elsewhere.

Public detail on this incident remains thin. Until more is confirmed, calm verification and basic account hygiene are the most useful responses available to ordinary people who may be connected to the organisation.

AICompiled with AI assistance from public sources and published under our editorial standards.