SINTTEL Listed by 8base Ransomware Group

On June 10, 2023, Brazilian trade union SINTTEL appeared on the leak site operated by the 8base ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the organization, which represents telecommunications workers in Minas Gerais. The number of people whose data was taken remains unknown, and the exact files posted have not been publicly detailed beyond the claim of successful exfiltration.

Reported Details from the Listing

The 8base leak site entry explicitly names SINTTEL and includes a short description highlighting the union’s role representing workers across multiple professional categories in Brazil. It states that data was taken in a ransomware incident and provides a link to the union’s website. The disclosure does not quantify the volume of records exposed, list specific data types such as member names, addresses, or financial details, or state whether any proof files were published. The incident was first surfaced through the group’s dedicated leak portal, accessible via the provided onion address.

Why This Matters for You and Your Family

When a trade union suffers a breach, the people most directly affected are its members, their spouses, and often their children whose details may appear in membership records, family benefit forms, or emergency contact lists. Internal files exfiltrated can easily contain home addresses, national identification numbers, phone numbers, email accounts, and employment histories. For ordinary families in Brazil this creates immediate risks of fraud, phishing campaigns tailored to union members, and long-term identity theft. Even if you are not a current SINTTEL member, shared suppliers, partner organizations, or past affiliations can still place your information in the same compromised environment.

Doxxing and Identity-Chain Risks

Union membership data frequently links real-world identity to professional handles, email addresses, and phone numbers that are later reused on other platforms. Once attackers obtain these connections they can map an entire household across social media, banking portals, government services, and children’s online gaming accounts. Credential leaks of this nature routinely cascade into account takeovers that expose private messages, location history, and financial details. The 8base listing, while light on technical specifics, signals that any member whose data was stored in the compromised systems now faces an elevated chance of doxxing chains that can persist for years.

8base Group Track Record

Public reporting attributes the emergence of 8base to mid-2022. The group has since listed hundreds of victims, focusing primarily on small and mid-sized organizations across North and South America. Typical playbook involves initial access through vulnerable remote desktop services or compromised credentials, followed by exfiltration of internal documents before encryption. 8base then uses its leak site to pressure victims with deadlines for payment, often publishing samples or full archives when demands are ignored. While not as widely publicized as some larger ransomware operations, consistent victim listings show a steady operational tempo and a willingness to target trade associations and unions.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by specialists.
• Rotate any password you used for SINTTEL member portals or related union services anywhere it has been reused, and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught and addressed in hours, not months.
• Cover the entire household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become entry points for further doxxing when parent credentials are leaked.
• Let remediation specialists manage takedown requests for any exposed personal documents or broker listings that surface from this incident.

The SINTTEL breach is a reminder that even organizations built to protect workers can become gateways that expose the very families they serve. Taking deliberate steps now limits how far attackers can travel down the identity chain created by this and future leaks. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts at risk from cascading credential leaks.