CIGAM Software Corporativo Ltda Listed by coinbasecartel Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
CIGAM Software Corporativo Ltda was listed by the coinbasecartel ransomware group on November 20, 2025, after internal files were exfiltrated in an attack. An undisclosed number of people may be affected; anyone who has shared data with the company should review their accounts and monitor for suspicious activity.
Breaking down the breach
The only confirmed detail is the appearance of CIGAM on the group’s listing on the reported date. The group claims to have obtained internal files, but no further technical description of the intrusion, encryption, or exfiltration method has been made public. The scale of the operation and whether any data was subsequently published remain undisclosed.Who is coinbasecartel?
Coinbasecartel is a ransomware operator that maintains a public leak site to list organizations it claims to have targeted. Such groups typically gain initial access through phishing, compromised credentials, or unpatched systems, then move laterally before deploying encryption and exfiltrating files. Their listings serve as a pressure tactic; confirmation that any specific claim reflects an actual breach requires independent verification by the named organization.About CIGAM Software Corporativo Ltda
CIGAM Software Corporativo Ltda develops and supplies enterprise resource planning software aimed at medium and large organizations. The company positions its platform as a tool for digital transformation, which means client systems often contain operational records, financial data, and personnel information processed on behalf of those enterprises. A compromise at a software provider in this sector can therefore extend beyond the company’s own records to data it handles for customers.The information in question
The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of specific file types, databases, or data categories has been released. Organizations that supply ERP systems commonly store configuration data, customer project files, and administrative records, yet the exact contents of the material claimed in this case are unconfirmed.What's at stake
For individuals whose information appears in the exfiltrated files, exposure could lead to targeted phishing or account misuse if credentials or personal identifiers are present. For CIGAM’s client organizations, the incident raises the possibility that operational or financial records processed through the ERP platform have left their control. The absence of Reported Details on data volume or sensitivity makes it difficult to quantify these risks at present.If your data was in this claimed breach
Monitor accounts associated with any services that use CIGAM’s platform and enable multi-factor authentication where available. Review bank and credit statements for unusual activity. Individuals can also run a free exposure scan of their email address against known breach datasets to determine whether their information has appeared in other incidents. Organizations should follow their incident-response procedures and consult legal or regulatory guidance on notification obligations.AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
CigamSoftware Listed by coinbasecartel Ransomware GroupInsight Listed by coinbasecartel Ransomware GroupILLUMINA Listed by coinbasecartel Ransomware GroupGDEV Listed by coinbasecartel Ransomware GroupLatest breaches
Publicly posted by coinbasecartel — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.