SINTTEL Listed by 8base Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target organisations that sit at the centre of working life, including trade unions that hold membership records, internal correspondence and operational files. Listings on criminal leak sites have become a routine way for these groups to pressure victims and advertise their activity, even when independent confirmation of what was taken remains limited.

On 10 June 2023, the Brazilian trade union SINTTEL was listed by the ransomware group known as 8base. Public reporting describes the incident as a ransomware attack in which internal files were said to have been exfiltrated. The number of people affected is unknown, and fuller technical detail has not been disclosed. For members, staff and partners, the listing raises practical questions about what may have been exposed and what steps are sensible while official clarity is incomplete.

Breaking down the breach

According to available reporting, SINTTEL appeared on 8base’s leak site on or around 10 June 2023. The group’s own statement claimed that it had “worked out” the union and framed the organisation as having standing among workers across professional categories in Brazil. The same material pointed to the union’s public website. Beyond that claim and the characterisation of the event as a ransomware attack involving exfiltration of internal files, public detail is limited.

No confirmed figure has been published for the number of people affected. No inventory of specific file names, volumes or systems has been released in the material summarised here. The precise initial access method, dwell time and whether encryption was also deployed on production systems are undisclosed. What is on record is the leak-site listing itself, the date it was reported, the attribution to 8base, and the description of internal files as having been taken in a ransomware attack. Those points should be treated as the boundary of verified public fact for this incident.

Who is 8base?

8base is a ransomware operation that became more visible in 2022–2023 through a leak site used to name alleged victims and publish samples or larger data sets when negotiations stall. Like other groups in this category, it has typically combined data theft with encryption pressure, threatening to release material unless a payment is made. Public tracking of the group has associated it with double-extortion style activity against organisations of varying size across multiple countries and sectors.

Its listings are claims made by the operators. They are not independent confirmation that every file advertised was taken, that every named organisation was fully compromised in the way described, or that published samples represent the full scope of an intrusion. In this case, 8base’s text about SINTTEL should be read as the group’s assertion—language intended to assert control and apply pressure—rather than as audited fact. No additional claims by the group about this victim beyond the reported summary are treated as established here.

About SINTTEL

SINTTEL is identified in the reporting as a trade union in Brazil, with a public presence at sinttelmg.org.br. Trade unions in this role typically represent workers across one or more professional categories, handle membership administration, collective bargaining, workplace representation and internal governance. They routinely hold contact details, employment-related information, correspondence with employers and members, financial and dues records, and documents tied to campaigns or legal support.

A breach affecting a union is consequential because the organisation sits between workers and employers. Compromise can touch not only staff systems but also data entrusted by members who expect confidentiality when they seek representation or assistance. Even when the exact contents of a theft remain unconfirmed, the sector context explains why such listings attract attention: unions concentrate personal and organisational information that is useful for fraud, social engineering or further targeting if it is misused.

The information in question

The facts available name the exposed material only in general terms: internal files exfiltrated in a ransomware attack. No public breakdown in the given record lists categories such as identity documents, bank details, health data or specific member databases. The number of individuals involved is unknown.

Organisations of this type commonly store membership rolls, contact information, dues and payment records, internal email and memos, negotiation files and documents related to workplace cases. That is a description of typical holdings, not a statement of what was allegedly taken from SINTTEL. Exact contents remain unconfirmed. Readers should not assume any particular data type was or was not included solely on the basis of the leak-site claim.

What's at stake

For people connected to the union—members, employees, former staff or partners—the main risks are practical rather than abstract. If contact details or internal documents surface, they can be used in phishing or impersonation attempts that reference real workplace or union matters. Financial or identity-related fields, if present in any stolen files, can support account takeover or fraud elsewhere. Even partial internal correspondence can help an attacker sound credible when contacting individuals.

For the organisation, stakes include disruption of normal representation work, cost of investigation and recovery, possible regulatory or contractual notification duties under applicable Brazilian rules, and erosion of member trust if communication is slow or unclear. None of these outcomes is proof of negligence; they are the ordinary consequences that follow when internal systems and files are claimed to have been accessed in a ransomware incident. Because scale and data types are undisclosed, the severity for any single person cannot be stated with precision from public facts alone.

Were you affected?

If you are a member, employee or partner of SINTTEL, treat unsolicited messages that cite the union, dues, workplace disputes or “urgent account issues” with caution. Prefer official channels you already trust rather than links or attachments in unexpected email or messaging. Consider monitoring financial accounts and enabling stronger authentication on email and other important services. If the union issues formal guidance or notification, follow those instructions.

Public confirmation of who was affected has not been provided, and the people-affected count remains unknown. As a further check, you can run a free exposure scan of your email address to see whether it has appeared in known breach data sets, which may help you decide whether to tighten passwords and watch for secondary misuse while more detail about this incident, if any, becomes available.

AICompiled with AI assistance from public sources and published under our editorial standards.