Ransomware Attack on COPLOSA S.A. by 8Base
Incident Date:
May 15, 2024
Overview
Title
Ransomware Attack on COPLOSA S.A. by 8Base
Victim
Coplosa S.A.
Attacker
8base
Location
First Reported
May 15, 2024
Ransomware Attack on COPLOSA S.A. by 8Base
Victim Overview
COPLOSA S.A., a chemical manufacturing company based in Barcelona, Spain, fell victim to a cyberattack by the ransomware group 8Base. They operate within the Chemicals industry, specializing in casting non-ferrous metals, particularly lead oxide production like Red Lead, Litharge, and powder for batteries, as well as Antimony trioxide production. The company is involved in process engineering for heat treatment of chemical products in powder form, utilizing furnaces, reactors, sampling devices, milling, and sampling dividers.
Company Details
The company is part of Grupo Penox, engaged in casting non-ferrous metals. COPLOSA is located in Barcelona, Catalonia, with an annual turnover ranging between 10 and 50 million euros. The company employs between 10 and 49 individuals and is registered in the Mercantile Registry of Barcelona. The company's most recent Borme announcement was on 02/06/2023, and its last deposit of annual accounts was for the 2022 fiscal year. The company's CIF is A08057622, and it has 80 executive positions. Notable individuals associated with COPLOSA SA include Jean Loudenot, Penox Group GmbH, RSM Spain Auditores SL, and others.
Attack Overview
The cybercrime group 8Base targeted COPLOSA S.A.'s website in the ransomware attack. Sensitive data such as invoices, receipts, accounting documents, personal data, certificates, employment contracts, and other confidential information were compromised in the attack.
Ransomware Group 8Base
8Base is known for its aggressive tactics and double-extortion strategy, where they encrypt files and threaten to release stolen data if the ransom is not paid. The group primarily targets small and medium-sized businesses across various sectors, including manufacturing. 8Base is believed to spread through phishing emails, exploit kits, and drive-by downloads. The group has gained notoriety for its rapid rise in activities and the use of customized ransomware strains like Phobos, appending ".8base" to encrypted files.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.