Cosef Listed by Booba Project Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware crews continue to use public leak sites as pressure tools, posting company names and claimed haul sizes before any independent verification. In that climate, a listing is a claim that requires careful handling, not an established breach report.

On September 23, 2026, the group known as Booba Project listed Cosef on its leak site, describing the organisation in connection with facilities services and asserting that 200 GB of data had been taken. Cosef has not publicly confirmed the claim as of writing. How many people, if any, are affected remains unknown, and the listing does not itemise what files or record types it purports to hold. For anyone linked to Cosef as a client, employee, supplier or partner, the practical question is what such a claim does and does not establish, and what to do if personal or business data later turns out to have been involved.

What the listing says

According to the Booba Project listing, Cosef appears under a headline framing the organisation as listed by the group, with a reported summary that characterises the matter as facilities services and “stolen data: 200 GB.” The date associated with the report is September 23, 2026. The listing does not disclose a count of affected individuals, does not name specific data categories, and does not describe a method of intrusion, a timeline of access, or any proof package beyond the group’s own assertion of volume.

Public detail is therefore limited to what the crew chose to publish: the organisation’s name, a sector-style label, a claimed data volume, and the fact of the listing itself. Nothing in the available record confirms that exfiltration occurred, that the stated volume is accurate, or that the material—if any—matches what organisations in facilities services commonly store. Until Cosef or a regulator speaks, the listing remains an unverified claim on an extortion site.

The group behind it: Booba Project

Booba Project is known in public reporting as a ransomware and data-extortion actor that follows a familiar pattern: encrypt or threaten encryption, exfiltrate data or claim to have done so, then name victims on a leak site to coerce payment. Like other groups in this category, it relies on publicity and countdown-style pressure rather than quiet negotiation alone. Listings are marketing as much as evidence; crews sometimes recycle older material, inflate sizes, or post names before any independent check.

For this Cosef entry specifically, only the group’s own words are on record. Booba Project claims a 200 GB haul tied to facilities services. It has not, in the facts available here, published a detailed inventory of file types, and there is no confirmed third-party validation of the claim. Readers should treat every assertion about what was taken as the group’s claim, not as a verified inventory.

Who is Cosef?

Cosef is identified in the listing in connection with facilities services—work that typically covers building operations, maintenance, cleaning, security support, property-related logistics, or similar outsourced site services. Organisations in this sector often sit between property owners, tenants, contractors and staff, and they commonly hold operational records, contracts, site details, and contact data for employees and clients.

A claimed incident against a facilities-services firm matters because those relationships can span many buildings and counterparties. Even when a leak-site post is unconfirmed, the possibility that business or personal information could surface creates uncertainty for people who never chose to deal with a ransomware crew. The consequence is not proof of loss; it is a need for calm, conditional vigilance until facts are clearer.

What was likely exposed

The listing does not disclose data types. Exact contents are unconfirmed. If files were taken from a facilities-services organisation, firms in this sector typically hold items such as employee and contractor contact details, schedules and site access-related records, client and vendor contracts, invoices and payment references, internal email or project correspondence, and sometimes floor plans or operational notes tied to buildings they support. That is a sector pattern, not a statement of what Booba Project holds in this case.

The only volume figure in the public claim is 200 GB. Volume alone does not reveal sensitivity: archives can mix mundane documents with identity or financial fields. Because people affected are listed as unknown and data categories as not disclosed, no one reading this should assume their own records are in the set—or that they are not. Conditional risk assessment is the honest stance until an official notice or independent analysis appears.

The real-world impact

If the claim were borne out, individuals could face phishing that references real workplaces or contracts, attempts to reset accounts using known email addresses, or fraud that misuses names, phone numbers or billing details. Organisations can face operational disruption, contractual notice duties, and long-running uncertainty about what circulated. None of that is established here as having already happened to Cosef’s stakeholders; it is the ordinary risk profile when extortion groups allege theft of business archives.

A leak-site listing also creates secondary harm: reputational noise, copycat scams that name the company, and pressure on staff who may be contacted by strangers claiming to have “their data.” Separating the group’s marketing from verified fact reduces that secondary harm. What the listing establishes is that Booba Project chose to name Cosef and assert a 200 GB figure on a stated date. What it does not establish is confirmation by the company, a regulator, or a breach index, nor a reliable map of whose records—if any—are involved.

If your data was involved

If you have a relationship with Cosef and later receive a credible notice, or if you see strong signs that your information appeared in circulated sets, treat the situation as conditional exposure: enable multi-factor authentication on email and work accounts, change passwords that may have been reused, watch for invoices or payment-change requests that play on facilities or vendor relationships, and be sceptical of urgent messages that cite this listing. Prefer official channels from Cosef or known partners over unsolicited “breach help” offers.

Document suspicious contacts, and consider credit or identity monitoring if financial identifiers were ever shared with the organisation and an official notice confirms exposure. You can also run a free exposure scan of your email to check whether your information has already surfaced in known breach data—useful context even when a specific listing remains unverified. Stay measured: a ransomware group’s claim is a starting point for caution, not proof that your files are already public.

AICompiled with AI assistance from public sources and published under our editorial standards.