Northcroft Listed by coinbasecartel Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Northcroft, a London-headquartered construction consultancy, was listed by the ransomware group coinbasecartel on or around 30 March 2026. The listing states that internal files were exfiltrated during a ransomware attack. No figure for the number of individuals affected has been released, and the company has not confirmed the incident or provided further details. The breach remains limited in verified information. The only confirmed element is the group’s public listing of Northcroft as a victim and its assertion that files were taken. Neither the volume of data, the precise date of the intrusion, nor the method of initial access has been disclosed. It is therefore not possible to determine the scope of exposure or whether any data has been published.

Breaking down the breach

Public reporting on the incident is confined to the single date of 30 March 2026 and the group’s claim of file exfiltration. No independent confirmation of the attack’s timing, the encryption of systems, or any ransom demand has appeared. The absence of these details leaves the operational impact on Northcroft’s projects and clients unquantified.

The group behind it: coinbasecartel

Coinbasecartel is a ransomware operator that follows the common pattern of encrypting victim systems and threatening to publish stolen data unless a ransom is paid. The group maintains a leak site where it lists organisations it claims to have compromised. Its listing of Northcroft constitutes an unverified assertion by the group; no corroborating evidence from law-enforcement sources or the company itself has been made public.

Who is Northcroft?

Northcroft is a construction consultancy established in 1840 and based in London. It provides project-management and cost-management services across sectors that include healthcare, transportation, education, commercial property and leisure. The firm operates internationally and routinely handles project documentation, contractual records and financial information belonging to both public and private clients.

What data was at risk

The only data category named in the listing is “internal files.” The precise contents of those files have not been disclosed. Organisations of this type typically store client contracts, cost estimates, design documents, employee records and correspondence; however, whether any of these categories were among the exfiltrated material remains unconfirmed.

What's at stake

Exposure of internal project files could reveal commercially sensitive information about ongoing developments, budgets and client relationships. If personal data relating to employees or third parties is present, those individuals face the standard risks associated with any large-scale data incident, including potential misuse of contact details or credentials. For the firm, the incident adds to the operational and reputational pressures already created by a ransomware event.

What to do if you're exposed

Individuals who believe their information may have been involved should monitor bank and email accounts for unusual activity and enable multi-factor authentication on all services. Changing passwords for any accounts that reuse credentials found in earlier breaches is a prudent first step. Readers can also run a free exposure scan of their email address against known breach data to check for prior appearances.

AICompiled with AI assistance from public sources and published under our editorial standards.