coinbase cartel
ransomware group · aka Coinbase Cartel, coinbase cartel · unknown; the brand is publicly associated with the ShinyHunters-linked actor cluster behind the 2025 Coinbase customer-data extortion (Google Threat Intelligence/Mandiant reporting, 2025). Reported ties to the broader 'Scattered Lapsus$ Hunters' community are not definitively confirmed. · active since 2025-05 (May 2025), when the 'Coinbase Cartel' name emerged during the Coinbase data-theft extortion campaign; subsequent leak-site victim posting tracked by public ransomware trackers since mid-2025.
Coinbase Cartel is a data-theft extortion group that rose to prominence in May 2025 when it extorted Coinbase over customer data stolen via bribed offshore support contractors, demanding a $20 million ransom (Coinbase SEC disclosure/company statement, 2025). It has since operated its own leak site, claiming victims across a wide range of sectors and geographies, including retail, insurance, healthcare, legal, transportation, and financial services. Public reporting describes pure extortion, with stolen data published or threatened for publication and no ransomware/encryption use documented; researchers have linked the brand to the ShinyHunters/Scattered Lapsus$ Hunters ecosystem. As tracked by this dashboard, the group has posted 58 victims since 2026-06-13, with its most recent post on 2026-08-31. No specific CVEs are publicly tied to its intrusions; reported access relies on social engineering and contractor/insider bribery rather than exploited software vulnerabilities.
- Voice phishing and social engineering of employees, help desks, and outsourced support staff
- Bribery of third-party support contractors to exfiltrate customer data from CRM systems (reported in the 2025 Coinbase breach)
- Pure data extortion: publication of stolen data on a leak site; no encryption or ransomware use documented
- Direct contact of victims' customers using stolen data to add pressure (reported during the 2025 Coinbase campaign)
- Broad, multi-region and multi-sector victim selection with no obvious geographic or industry focus
- Publicly associated by researchers with the ShinyHunters/Scattered Lapsus$ Hunters ecosystem, known for SaaS/CRM-focused vishing; per-post attribution is uncertain
Westwing Group SE, Integrated Health Systems, RXPE Group, Tower Insurance, Flecha Bus, OTEIS Conseil & Ingénierie, Longhorn Investments, Kessler Creative, Klasko Immigration Law Partners, Patel
No public figure.
Leak-site victims240 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Colliers Real Estate | · Jul 27, 2026 | Real Estate - $5.7 Billion |
| Axiom Global | · Jul 22, 2026 | Business Services - $19.2 Million |
| Colliers Real Estate NEW | · Jul 20, 2026 | Real Estate - $5.7 Billion |
| Caterpillar | · Jul 20, 2026 | Manufacturing - $67 Billion |
| PanasonicAero | · Jul 15, 2026 | Aerospace - $2.71 Billion |
| Axiom Global NEW | · Jul 14, 2026 | Business Services - $19.2 Million |
| Demand.io | · Jun 13, 2026 | Advertising - $10.5 |
| Cambridge Mobile Telematics | · Jun 13, 2026 | Telematics - $200 Million |
| Demand.io NEW | · Jun 5, 2026 | Advertising - $10.5 |
| Cambridge Mobile Telematic NEW | · Jun 5, 2026 | Telematics - $200 Million |
| Cambridge Mobile Telematics NEW | · Jun 2, 2026 | Telematics - $200 Million |
| Panasonic.Aero | · Jun 2, 2026 | Afve-Papppppppppppppl, , |
| - Cognizant | · May 29, 2026 | Tech - $21.1 Billion |
| Siveco - | · May 22, 2026 | Tech - $123.7 Million |
| - Cognizant NEW | · May 22, 2026 | Tech - $21.1 Billion |
| Openmind networks NEW | · May 22, 2026 | Software - $20.1 Million |
| Pragmatic Solutions NEW | · May 22, 2026 | Casino Erp - Undisclosed |
| Openmind networks | · May 21, 2026 | Software - $20.1 Million |
| Pragmatic Solutions | · May 21, 2026 | Casino Erp - Undisclosed |
| Panasonic Aero | · May 21, 2026 | Aero - $2.7 Billion |
| Zywave | · May 15, 2026 | — |
| Grafana | · May 15, 2026 | — |
| Buenos Aires Software | · May 13, 2026 | — |
| Jozef Stefan Institute (IJS) | · May 12, 2026 | — |
| Alpinion | · May 12, 2026 | — |
| Tab Service | · May 12, 2026 | — |
| Cass information Systems | · May 12, 2026 | — |
| Sanna Web | · Apr 23, 2026 | — |
| Peru LNG (Hunt LNG Operating Company) | · Apr 23, 2026 | — |
| Aptim | · Apr 23, 2026 | — |
| Kementerian Pertanian | · Apr 23, 2026 | — |
| Sea Telecom Br | · Apr 23, 2026 | — |
| Precision Coating | · Apr 23, 2026 | — |
| Integer Holdings | · Apr 23, 2026 | — |
| SIG.biz | · Apr 20, 2026 | — |
| Commscope | · Apr 20, 2026 | — |
| Playmates Toys | · Apr 20, 2026 | — |
| Engie | · Apr 20, 2026 | — |
| ASTM Group | · Apr 19, 2026 | — |
| Securitevolfeu | · Apr 18, 2026 | — |
| Altpro | · Apr 18, 2026 | — |
| McCuaig and associates Engineering | · Apr 18, 2026 | — |
| Evict them for me | · Apr 18, 2026 | — |
| The Epoch Times | · Apr 15, 2026 | — |
| Canada Goose - Updated with proof | · Apr 15, 2026 | — |
| Lacoste - Updated with proof | · Apr 15, 2026 | — |
| UOM University | · Apr 15, 2026 | — |
| Vluznet | · Apr 15, 2026 | — |
| Epoch Times | · Apr 15, 2026 | — |
| Superintendency of territorial planning | · Apr 15, 2026 | — |
In the newsAll →
No articles mention this group yet.