ILLUMINA Listed by coinbasecartel Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target organisations holding sensitive research and operational data, with listings on leak sites becoming a common pressure tactic in 2025. On 16 December 2025, the group coinbasecartel listed ILLUMINA on its site, claiming to have exfiltrated internal files during a ransomware operation. The number of individuals affected remains unknown, and no further details about the scope or confirmation of the incident have been made public.

What happened

The incident centres on a listing posted by coinbasecartel on 16 December 2025. The group states that it carried out a ransomware attack against ILLUMINA and removed internal files. No information has been released about the date of the intrusion, the volume of data taken, the encryption status of systems, or whether any ransom demand was issued or met. Public reporting at this stage is limited to the leak-site claim itself.

The group behind it: coinbasecartel

Coinbasecartel is a ransomware operator that maintains a leak site to publish names of claimed victims and, in some cases, samples of stolen material. Groups of this type typically gain initial access through phishing, exposed remote services or supply-chain weaknesses, then move laterally to locate and exfiltrate data before deploying encryption. Their listings function as both a reputational threat and a signal to other potential targets. The present entry concerning ILLUMINA is presented by the group as one of its operations; independent confirmation of the underlying events has not been published.

About ILLUMINA

ILLUMINA develops and supplies sequencing and array-based platforms used for genetic and genomic analysis. Its customers include research institutions, clinical laboratories and pharmaceutical companies operating in the United States, Singapore, the United Kingdom and other jurisdictions. The company therefore processes and stores data related to genomic workflows, instrument performance, research collaborations and internal business functions.

What was likely exposed

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of file types, databases or record counts has been disclosed. Organisations in this sector routinely hold genomic sequence data, project documentation, instrument logs, partner agreements and employee records. Until ILLUMINA or a verified investigation publishes further detail, the precise contents of the claimed exfiltration remain unconfirmed.

What's at stake

Genomic and research files can contain information that is difficult to change and that carries long-term privacy implications for research participants or patients. For the organisation, exposure of internal operational material may affect competitive research programmes or contractual relationships. At present there is no public indication of how the claimed data might be used or whether it has been offered for sale.

Were you affected?

Individuals who have interacted with ILLUMINA in a research, clinical or employment capacity have no confirmed public list against which to check. A practical first step is to monitor official statements from the company and to review any direct notifications that may be issued. Running a free exposure scan of one’s email address against known breach data sets can reveal whether the address has appeared in previously published incidents, providing a baseline for personal vigilance.

AICompiled with AI assistance from public sources and published under our editorial standards.