Intermountain Listed by 8Base Ransomware Group

On July 29, 2022, Intermountain Centers for Human Development, Inc. appeared on the leak site of the 8base ransomware group. The Arizona-based nonprofit behavioral health and child welfare organization, which operates a network of subsidiaries including Intermountain Health Center, Intermountain Foster Care, and Intermountain Academy, may have had its internal files exfiltrated during a ransomware attack. Anyone who has received services from Intermountain or whose family member has been part of its foster care, behavioral consultation, or mental health programs may have their personal information at risk.

Details from the 8base Listing

The 8base leak site listing states that Intermountain Centers suffered a ransomware attack in which internal files were exfiltrated. The disclosure does not quantify how many records were taken, list specific data types such as patient names, Social Security numbers, or clinical notes, or provide any sample files. It simply states that data was stolen and gives the victim a deadline to negotiate before further publication. The exact volume and sensitivity of the exposed material therefore remain unknown to the public.

Intermountain Centers is a statewide nonprofit that delivers integrated behavioral health services, intensive child welfare programs, foster care, and educational support across Arizona. Its clients include vulnerable children, families in crisis, and individuals receiving long-term mental health care. Any records taken would likely contain highly personal details collected during treatment, placement, or counseling.

Why This Matters for You and Your Family

If you or a child have used Intermountain’s services, your information could now sit in a ransomware actor’s hands. Behavioral health records often include diagnoses, therapy notes, medication histories, family dynamics, and contact details for parents, guardians, and emergency contacts. Child welfare files add addresses, school records, court documents, and financial information used for foster care or adoption services. Exposure of this data can lead to insurance fraud, identity theft, stalking, or blackmail targeting already-stressed households.

Even when the leak site does not publish samples, ransomware operators frequently hold the full archive and selectively release or sell portions later. The absence of a published record count does not mean your data is safe; it simply means the full scope has not yet been disclosed.

Doxxing and Identity-Chain Risks

Behavioral health and child welfare records create long identity chains. An email address or phone number tied to a parent’s therapy session can be linked to a child’s foster care file, school records, and gaming usernames. Once one handle surfaces, attackers can map it to social media, streaming accounts, and family addresses. This chaining turns a single breach into repeated targeting across years. Credential leaks from healthcare providers frequently cascade into account takeovers on gaming platforms, where children’s usernames and passwords are reused.

DoxxScan by GalaxyWarden continuously monitors 13.1 billion+ breach records across more than 100 platforms and uses AI-powered identity-chain mapping to connect handles, emails, phones, and real-world identities. Its specialists also provide hands-on remediation and household coverage that includes children’s gaming accounts, which are often the next link in these doxxing chains.

8base’s Publicly Known Track Record

Public reporting attributes the emergence of 8base to mid-2022. The group rapidly built a reputation for targeting mid-sized organizations, especially in healthcare, education, and professional services. Notable prior victims have included municipal governments, manufacturing firms, and other nonprofits. 8base’s typical playbook involves initial access through compromised remote desktop protocol credentials or vulnerable web applications, followed by claimed exfiltration of sensitive files before deploying ransomware. The group then lists victims on its dark-web site and pressures them with threats of data publication or sale on underground forums. While some ransomware operators emphasize encryption, 8base focuses heavily on the extortion value of stolen data.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring so the next breach exposing you or your family is caught in hours rather than months.
• Rotate any password you ever used with Intermountain Centers anywhere it has been reused, and switch to 2FA through an authenticator app instead of text messages.
• Cover the entire household because DoxxScan family protection extends to dependents and children’s gaming accounts that can chain back to the same breached records.
• Let remediation specialists manage takedown requests for any exposed personal documents or broker listings that surface from this incident.

The incident shows how quickly a single healthcare provider breach can ripple into lifelong identity risks for families already navigating difficult circumstances. Staying ahead requires more than reactive checks; it demands ongoing visibility and expert help. Start your DoxxScan trial today to gain that visibility and put specialists to work protecting your household.