REUS MOBILITAT I SERVEIS Listed by 8base Ransomware Group

On December 13, 2023, the municipal company REUS MOBILITAT I SERVEIS appeared on the leak site of the 8base ransomware group. The Spanish operator of public car parks and the blue-zone parking system in the city of Reus had its internal files exfiltrated during a ransomware attack. The listing does not quantify how many people are affected, nor does it specify the exact volume or types of documents stolen.

Details from the 8base Listing

The primary disclosure on the 8base leak site states that REUS MOBILITAT I SERVEIS (AMERSHAM) suffered a ransomware incident and that attackers successfully exfiltrated internal files. The company, which runs a centralized control center overseeing automated parking facilities across Reus, maintains the reusmobilitat.cat domain. No ransom amount, exact data categories, or number of records appears in the posting. The leak site simply states that data was taken and gives the victim a deadline to negotiate before public release of the material.

Public reporting on 8base indicates the group often posts victim names and sample data to pressure payment. In this case the disclosure indicates that at least some internal operational files left the organization’s network.

Why This Matters for You and Your Family

When a city parking authority is breached, the information exposed is rarely limited to parking tickets. Municipal contractors routinely store customer names, vehicle registration numbers, payment card details, addresses, phone numbers, and sometimes national identification numbers. If you live in Reus or have used the blue-zone parking or any of the managed car parks in the past few years, your personal data may now sit in an attacker’s archive. Even when the leak-site listing does not detail what was taken, the real-world exposure can lead to identity theft, fraudulent parking fines, or targeted phishing campaigns that appear to come from local government.

Households feel these incidents directly. A single leaked address or phone number can be combined with other publicly available records to build a profile that puts every family member at risk of scams, unwanted solicitations, or worse.

Doxxing and Identity-Chain Risks

Ransomware groups do not stop at one dataset. Once internal files are in their possession, actors map relationships between email addresses, phone numbers, employee accounts, and customer records. These linkages create doxxing chains that can expose family members who never directly interacted with the parking service. A parent’s parking account tied to a home address can quickly surface children’s names, schools, or even gaming usernames if the same email or phone appears in multiple breaches.

Credential leaks like this one cascade into account takeovers across unrelated services. An email address used to register for parking permits is often reused for online shopping, banking, or children’s gaming platforms. Attackers follow these chains, turning a municipal breach into long-term identity exposure that can last for years.

8base’s Publicly Known Track Record

Public reporting attributes the first major activity of 8base to early 2022. The group rose quickly by targeting mid-sized organizations across North America, Europe, and Latin America. Notable prior victims include manufacturing firms, technology service providers, and local government contractors. Their typical playbook begins with initial access gained through compromised remote desktop credentials or vulnerable web applications, followed by rapid exfiltration of internal file shares before encryption. 8base then uses a double-extortion model: they threaten both data encryption and public release of stolen documents unless a ransom is paid. The group maintains a professional leak site that lists victims who do not meet payment deadlines, often giving them only a few days to respond after initial contact.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours rather than months.
• Rotate any password you have used on reusmobilitat.cat or related municipal services anywhere it is reused, and switch to 2FA through an authenticator app instead of SMS.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists manage takedown requests for any exposed personal documents or broker listings that surface from this incident.

The breach of REUS MOBILITAT I SERVEIS shows how even routine municipal services can become gateways to personal exposure for thousands of local families. Staying ahead requires more than reactive checks; it demands ongoing visibility into how your information travels across the internet. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to close the gaps this incident has opened.