ATG - New samples added Listed by coinbasecartel Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
ATG disclosed on March 15, 2026, that internal files were exfiltrated during a ransomware attack claimed by the coinbasecartel group. Individuals connected to ATG should review their accounts and monitor for unusual activity.
Inside the incident
The only confirmed information is the listing itself and the statement that internal files were allegedly exfiltrated during a ransomware attack. No count of records, no description of the files, and no confirmation of encryption or ransom demands have been released. The date the data were taken and the method of initial access remain undisclosed.
Inside coinbasecartel
Coinbasecartel is a ransomware operation that maintains a public leak site where it lists organizations it claims to have compromised. The group typically combines file encryption with the theft of data, then uses the threat of publication to pressure victims. Its listings are presented by the group as evidence of successful intrusions, though independent verification of each claim is not always available.
Who is ATG?
ATG is an organization whose internal systems were targeted in the reported incident. Entities of this type routinely maintain records related to operations, personnel, partners, and customers. A compromise of such systems can expose information that is not intended for public release and that may be difficult to replace or contain once removed.
What data was at risk
The listing states that internal files were exfiltrated. No further breakdown of file categories or record counts has been provided. Organizations in this sector commonly store employee records, financial documents, communications, and operational data; however, the precise contents of the exfiltrated material have not been confirmed.
The real-world impact
Exposure of internal files can lead to follow-on risks such as targeted fraud, misuse of credentials, or reputational harm for the organization and any individuals referenced in the documents. The absence of Reported Details means the scale of these risks cannot yet be quantified for those potentially affected.
Were you affected?
Individuals can check whether their email address appears in known breach data by using a reputable exposure-scanning service. If ATG has contacted you directly, follow any instructions it provides for monitoring accounts or changing credentials. Organizations that hold personal information are expected to notify affected parties when required by applicable regulations.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
RAKS Sp. z o.o. b Leaked Listed by coinbasecartel Ransomware GroupPeru LNG (Hunt LNG Operating Company) Listed by coinbasecartel Ransomware GroupAltpro Listed by coinbasecartel Ransomware GroupRogiken / institute of Science Tokyo Listed by coinbasecartel Ransomware GroupLatest breaches
Publicly posted by coinbasecartel — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.