Telepizza Listed by 8base Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target consumer-facing companies whose operations depend on customer records, supplier contracts and internal systems. Listings on criminal leak sites have become a routine pressure tactic, even when independent confirmation of what was taken remains thin. Against that backdrop, the Spanish pizza chain Telepizza appeared on a ransomware group’s site in mid-2023, adding another food-service name to the growing roster of claimed victims.

Public reporting on 13 July 2023 stated that Telepizza had been listed by the 8base ransomware group, which asserted that internal files had been exfiltrated. The number of people affected is unknown, and further technical detail has not been released. For customers, employees and partners, the listing itself is enough to warrant attention, because even limited internal material can contain personal or commercial data that later surfaces in secondary markets.

Breaking down the breach

According to the available record, Telepizza was listed by 8base on or around 13 July 2023. The group claimed that internal files had been taken in a ransomware attack. No confirmed figure for the volume of data, no list of specific file types beyond the general description “internal files,” and no public statement on whether encryption of production systems also occurred have been supplied in the facts at hand. The number of individuals potentially affected remains unknown. Because the primary source is the group’s own leak-site claim, the incident should be treated as an unverified assertion until the company or independent investigators provide corroboration. Timing of the initial intrusion, the entry vector, and any ransom demand are undisclosed.

The group behind it: 8base

8base is a ransomware operation that emerged more prominently in 2022–2023 and follows the now-common double-extortion model: data are stolen before systems are encrypted, and the threat of public release is used to increase pressure. The group maintains a leak site where it names victims and, in some cases, publishes sample files. Like many such actors, 8base has historically focused on mid-sized organisations across multiple sectors rather than exclusively on large enterprises, and it has been observed using relatively straightforward phishing or exposed-service initial access in other campaigns. Public reporting has linked the brand to affiliates who conduct the intrusions and then rely on the 8base infrastructure for negotiation and leaking. None of that general pattern constitutes proof of the precise methods used against Telepizza; the only claim specific to this case is the group’s listing itself and its assertion that internal files were exfiltrated.

About Telepizza

Telepizza is a well-known Spanish pizza-delivery and restaurant chain founded in Madrid in 1987. It grew from a family business into an international brand, opening its first factory in 1992 and expanding across Europe and Latin America. The company operates both company-owned and franchised outlets and runs ordering platforms, loyalty programmes and supply-chain systems typical of large quick-service restaurant groups. Organisations of this type ordinarily hold customer contact details, delivery addresses, payment-related records, employee information, franchisee contracts and internal operational documents. A breach affecting such an operator is consequential because the data touch both private individuals who order food and the commercial network that keeps stores running. Even when the precise contents of a claimed theft remain unconfirmed, the sector’s reliance on high-volume personal and transactional data makes any credible listing worth examining.

The information in question

The facts state only that internal files were allegedly exfiltrated in a ransomware attack. No inventory of data categories—such as customer databases, employee records, financial files or source code—has been published in the material provided. Exact contents are therefore unconfirmed. Companies in the quick-service and home-delivery sector commonly store names, phone numbers, email addresses, physical addresses, order histories and, in some cases, partial payment data, together with human-resources files and supplier agreements. It is not known whether any of those categories were among the files 8base claims to hold. Until Telepizza or a trusted third party releases a verified description, affected parties should treat the exposure as possible rather than proven and avoid assuming that any particular record type was or was not involved.

Why it matters

For individuals, the practical risk is that contact or address information, if present, could be used for targeted phishing, smishing or identity-related fraud. Internal corporate files can also contain credentials, network diagrams or commercial terms that enable follow-on attacks against the company or its partners. For Telepizza, a public listing can damage customer trust, trigger regulatory notification duties under European data-protection rules, and impose recovery and legal costs even if the full scope stays limited. Because the scale remains unknown, neither the absence of dramatic headlines nor the presence of a leak-site post should be read as a final measure of harm; the real impact depends on what was actually taken and how it is later misused. Calm monitoring and basic hygiene remain more useful than speculation.

If your data was in this claimed breach

If you have ordered from Telepizza, worked for the company or its franchisees, or otherwise shared personal details with the brand, treat the listing as a prompt to review your exposure rather than as confirmed proof that your records were allegedly stolen. Change passwords on any related accounts, enable multi-factor authentication where available, and watch for unexpected messages that reference recent orders or internal company matters. Consider placing fraud alerts with relevant credit or identity services if you believe financial data could have been involved. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets, which provides an additional, independent signal beyond this single incident. Keep records of any suspicious contact and report confirmed misuse to local authorities and the company through official channels only.

AICompiled with AI assistance from public sources and published under our editorial standards.