CHECKMARX Listed by lapsus$ Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 25, 2026, the ransomware group lapsus$ listed Checkmarx on its leak site. The listing states that internal files were exfiltrated in a ransomware attack. No figure has been released for the number of individuals affected, and the company has not issued a public confirmation of the claims. The incident adds to a pattern of targeted operations against technology and security vendors. Such listings draw attention because they involve organisations that hold sensitive development materials and credentials.

Breaking down the breach

The only confirmed public detail is the April 25, 2026 listing by lapsus$. The group asserts that source code, an employee database, API keys, and MongoDB/MySQL credentials were taken. No information has been released on the date of the intrusion, the volume of data, the method of access, or whether any data was subsequently published or sold.

Public records contain no independent verification of the exfiltration or of any ransom demand. The scale of exposure and the precise contents of the claimed files remain undisclosed.

The group behind it: lapsus$

Lapsus$ is a ransomware operator that has conducted multiple high-profile intrusions since 2021. The group typically combines social-engineering tactics with credential theft to gain initial access to corporate networks. Once inside, it focuses on data exfiltration rather than solely on encryption.

Its targets have included software developers, telecommunications firms, and other technology companies. The group maintains a leak site where it lists victims and, in some cases, posts samples of claimed data. Any specific claim about Checkmarx originates solely from this listing and has not been corroborated by other sources.

CHECKMARX and its sector

Checkmarx develops static and interactive application-security testing tools used by software teams to identify vulnerabilities in source code. Its customers are primarily enterprises that integrate these tools into development pipelines.

Organisations in this sector routinely store proprietary codebases, customer project data, internal authentication material, and employee records. A compromise at such a firm can therefore expose both the vendor’s own infrastructure and artefacts belonging to its clients.

What was likely exposed

The lapsus$ listing names source code, an employee database, API keys, and MongoDB/MySQL credentials as having been exfiltrated. These categories align with the types of material commonly held by application-security vendors.

No independent confirmation of the data types or their completeness has been published. The exact scope of any exposure therefore remains unverified.

What's at stake

Exposed source code can reveal implementation details that assist further attacks against the same or related systems. API keys and database credentials, if still valid, could allow unauthorised access to internal or customer environments.

Employee records may contain contact information and authentication data that could be used for targeted phishing or credential-stuffing campaigns. The absence of a confirmed victim count makes it difficult to quantify direct personal impact at this stage.

What to do if you're exposed

Individuals who believe their information may be involved should change passwords for any accounts associated with Checkmarx services and enable multi-factor authentication where available. They should also monitor for unusual login attempts and review access logs for any systems that used the listed credentials.

Readers can run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information. Organisations should treat any listed credentials as potentially compromised and rotate them immediately.

AICompiled with AI assistance from public sources and published under our editorial standards.