Pellenc Listed by coinbasecartel Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On January 31, 2026, the ransomware group coinbasecartel listed Pellenc on its leak site and stated that internal files had been taken during a ransomware attack. No figure for the number of people affected has been released, and further details about the incident remain limited to that single claim. The listing adds Pellenc to the list of organisations whose data has appeared on such sites in recent months. Public reporting has not yet confirmed whether the files were published or whether any ransom demands were met.

Breaking down the breach

The only confirmed information is the date the listing appeared and the group’s assertion that internal files were exfiltrated. No volume of data, number of records, or timeline of the intrusion has been disclosed. It is not known whether encryption was also deployed or whether any systems were restored from backups.

The group behind it: coinbasecartel

Coinbasecartel is a ransomware operator that maintains a leak site where it lists victims and, in some cases, posts samples of stolen material. Groups of this type typically gain initial access through phishing, compromised remote-access tools or unpatched internet-facing systems, then move laterally to locate and copy data before deploying encryption. Their public listings serve as a form of pressure in extortion negotiations. The group’s claim regarding Pellenc has not been independently verified beyond the appearance of the listing itself.

Pellenc and its sector

Pellenc is a French manufacturer founded in 1973 that produces battery-powered tools and machinery for horticulture, viticulture, forestry and municipal maintenance. Its product range includes vine harvesters, olive harvesters and ground-care equipment. The company holds more than one thousand patents and operates internationally. Organisations in this sector routinely store design specifications, supplier contracts, customer records and internal communications that can contain commercially sensitive information.

The information in question

The listing refers only to “internal files exfiltrated in ransomware attack.” No further breakdown of file types or data categories has been provided. Companies of this kind commonly hold engineering documents, employee records, financial data and customer contact information, but the precise contents of the exfiltrated material are unconfirmed.

The real-world impact

Exposure of internal files can create operational and competitive risks for the organisation and may lead to follow-on fraud or targeted phishing against individuals whose details appear in those files. Because the scale and nature of the data remain unknown, the extent of any personal impact cannot yet be assessed.

If your data was in this claimed breach

Individuals who have any connection to Pellenc should treat the incident as a prompt to review their own account security. Practical first steps include:

• Changing passwords for any accounts linked to the organisation and enabling multi-factor authentication where available.
• Monitoring bank and credit statements for unusual activity.
• Running a free exposure scan of their email address against known breach data to check for prior appearances.

Organisations should also confirm whether they have received any direct notification from Pellenc and follow any guidance the company eventually issues.

AICompiled with AI assistance from public sources and published under our editorial standards.