ZeroHour

coinbase cartel

ransomware group · aka Coinbase Cartel, coinbase cartel · unknown; the brand is publicly associated with the ShinyHunters-linked actor cluster behind the 2025 Coinbase customer-data extortion (Google Threat Intelligence/Mandiant reporting, 2025). Reported ties to the broader 'Scattered Lapsus$ Hunters' community are not definitively confirmed. · active since 2025-05 (May 2025), when the 'Coinbase Cartel' name emerged during the Coinbase data-theft extortion campaign; subsequent leak-site victim posting tracked by public ransomware trackers since mid-2025.

Victims · 7d
0flat
Victims · 30d
37active targets
Victims · 90d
56
All-time (tracked)
240since 2025-09-15
Last post
08-31 00:30UTC
Estimated earnings
public reporting
Profile · glm-5.3-flash · updated

Coinbase Cartel is a data-theft extortion group that rose to prominence in May 2025 when it extorted Coinbase over customer data stolen via bribed offshore support contractors, demanding a $20 million ransom (Coinbase SEC disclosure/company statement, 2025). It has since operated its own leak site, claiming victims across a wide range of sectors and geographies, including retail, insurance, healthcare, legal, transportation, and financial services. Public reporting describes pure extortion, with stolen data published or threatened for publication and no ransomware/encryption use documented; researchers have linked the brand to the ShinyHunters/Scattered Lapsus$ Hunters ecosystem. As tracked by this dashboard, the group has posted 58 victims since 2026-06-13, with its most recent post on 2026-08-31. No specific CVEs are publicly tied to its intrusions; reported access relies on social engineering and contractor/insider bribery rather than exploited software vulnerabilities.

Tactics & tooling
  • Voice phishing and social engineering of employees, help desks, and outsourced support staff
  • Bribery of third-party support contractors to exfiltrate customer data from CRM systems (reported in the 2025 Coinbase breach)
  • Pure data extortion: publication of stolen data on a leak site; no encryption or ransomware use documented
  • Direct contact of victims' customers using stolen data to add pressure (reported during the 2025 Coinbase campaign)
  • Broad, multi-region and multi-sector victim selection with no obvious geographic or industry focus
  • Publicly associated by researchers with the ShinyHunters/Scattered Lapsus$ Hunters ecosystem, known for SaaS/CRM-focused vishing; per-post attribution is uncertain
Targeted sectors
Retail / e-commerceInsuranceHealthcareLegal servicesTransportation / logisticsFinancial services / microfinanceEngineering / industrialMarketing / creative services
Notable public victims

Westwing Group SE, Integrated Health Systems, RXPE Group, Tower Insurance, Flecha Bus, OTEIS Conseil & Ingénierie, Longhorn Investments, Kessler Creative, Klasko Immigration Law Partners, Patel

Estimated earnings

No public figure.

Leak-site victims

VictimDiscoveredDetails
GL Steel · Apr 15, 2026
Wayne Brothers Construction · Apr 15, 2026
Questivity · Apr 15, 2026
Millenium Packaging · Apr 15, 2026
Kemenpppa · Apr 15, 2026
Rogiken / institute of Science Tokyo · Apr 15, 2026
La Maison Bleue France · Apr 15, 2026
Sampol · Apr 15, 2026
Astreya · Apr 15, 2026
Cognizant · Apr 15, 2026
Flash Charm INC - (IDERA) · Apr 14, 2026
Helzberg · Apr 12, 2026
Ralph Lauren · Apr 12, 2026
Carters · Apr 12, 2026
JBS Brazil - Sample uploaded · Apr 8, 2026
Marlborough Partners · Apr 8, 2026
Scholle IPN · Apr 8, 2026
Balfour Beatty · Apr 8, 2026
KEB · Apr 8, 2026
Correios · Apr 8, 2026
EasTech · Apr 8, 2026
Idera - · Apr 8, 2026
RAKS Sp. z o.o. b Leaked · Apr 2, 2026
PC SOFT FRANCE - Leaked · Apr 2, 2026
PC SOFT FRANCE - Leaked data · Mar 30, 2026
Net Solace · Mar 30, 2026
Posiflex · Mar 30, 2026
Dronena · Mar 30, 2026
Siveco · Mar 30, 2026
Northcroft · Mar 30, 2026
Silver Peak · Mar 30, 2026
Buffalo Neuroimaging Analysis Center · Mar 30, 2026
Nashua · Mar 30, 2026
Studiosus Reisen Munchen · Mar 30, 2026
Efficy - 43gb leaked · Mar 30, 2026
Verimatrix - 43gb Leaked · Mar 30, 2026
Propertyfinder / PropSpace CRM - In aucitioin place your bids now !!! · Mar 30, 2026
Genobank · Mar 28, 2026
Tecnocad Group · Mar 19, 2026
PC SOFT FRANCE · Mar 19, 2026
Onyx Graphics · Mar 19, 2026
Tecnocap Group · Mar 19, 2026
Verimatrix · Mar 19, 2026
Ariston · Mar 19, 2026
Petra Industries · Mar 19, 2026
Augenomics · Mar 15, 2026
nChroma Bio · Mar 15, 2026
Geno Bank · Mar 15, 2026
Neochromosome · Mar 15, 2026
Novogene · Mar 15, 2026

In the newsAll →

No articles mention this group yet.

Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .