Council for Relationships Listed by 8base Ransomware Group

On April 15, 2024, the Council for Relationships appeared on the leak site operated by the 8base ransomware group. The nonprofit organization, which provides therapy services, clinician training in family systems, and behavioral health research, is claimed to have had internal files exfiltrated during a ransomware attack. The leak-site listing does not specify the number of people affected or detail the exact contents of the stolen data.

Details from the 8base Listing

The primary disclosure on the 8base leak site states that Council for Relationships suffered a ransomware incident in which attackers successfully exfiltrated internal files. No victim count is provided, and the listing does not break down the types of records taken beyond describing them as internal files. The organization’s public description confirms it serves individuals and families seeking relationship counseling, professional development for therapists, and contributions to behavioral health research through its Philadelphia-area operations.

April 15, 2024 marks the date the group chose to publicize the victim on its extortion platform. As is typical with these listings, a deadline for payment was set, after which samples or larger portions of the data would be released. The disclosure itself remains the sole official public record of the breach at this time.

Why This Matters for You and Your Family

When a counseling organization is breached, the people most likely to be exposed are those who sought help for deeply personal matters. Therapy notes, intake forms, billing records, and correspondence often contain names, addresses, dates of birth, Social Security numbers, insurance details, and descriptions of family conflicts, mental health history, or substance use. Even if the exact data types are not yet public, the internal files taken in this ransomware attack almost certainly include information that could cause embarrassment, identity theft, or targeted harassment if released.

Your family’s private struggles should not become public ammunition. A single breach like this can link your real identity to sensitive life events years later, affecting employment background checks, insurance applications, or even child-custody disputes. The absence of a published victim count does not reduce the risk; it simply means the full scope remains unknown to the public.

Doxxing and Identity-Chain Risks

Ransomware operators rarely stop at one dataset. Once internal files leave the victim’s network, they can be traded, sold, or combined with other leaks. An email address used to schedule therapy sessions might already appear in an earlier breach. Attackers or opportunistic criminals then stitch these fragments together, mapping your online handles, phone numbers, family members’ names, and physical address into a complete profile. This identity chain makes you easier to impersonate, blackmail, or stalk.

Credential leaks from counseling providers frequently cascade into account takeovers elsewhere. The same password or security questions used for a patient portal may protect your email, banking, or children’s gaming accounts. When those gaming accounts are hijacked, attackers can harvest additional personal details or use the child’s identity as another link in the chain. Continuous monitoring across large breach repositories is one of the few practical ways to detect these connections before they are exploited.

8base’s Publicly Known Track Record

Public reporting attributes the emergence of 8base to mid-2022. The group functions primarily as a ransomware-as-a-service operator, providing infrastructure and leak sites to affiliate attackers. It has claimed responsibility for incidents against hundreds of organizations, focusing on mid-sized businesses, healthcare providers, and nonprofits. Notable prior victims include municipal governments, manufacturing firms, and professional service organizations.

The group’s typical playbook involves initial access through compromised remote desktop credentials or exploited vulnerabilities in common business software. Once inside, affiliates exfiltrate data before deploying ransomware. Extortion then proceeds in two stages: first demanding payment to decrypt files, then threatening to publish the stolen data on the 8base leak site if a second ransom is not paid. The group maintains a professional-looking portal and often gives victims short deadlines, usually seven to fourteen days, before samples appear.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity, then use the cleanup of Warden to remove what you can.
• Rotate any password you ever used when registering for services at Council for Relationships and enable 2FA with an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught and acted on in hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which often become targets when credential leaks create doxxing chains.
• Let remediation specialists handle takedown requests for any exposed personal records that surface on data-broker sites or underground forums.

The Council for Relationships breach is a reminder that even organizations dedicated to helping families can become gateways to identity theft and long-term harassment. Acting quickly on the credentials and personal details you cannot see is the most effective defense. Start your DoxxScan trial and combine its AI-powered identity-chain mapping with hands-on remediation by specialists to protect yourself and your family today.