Peru LNG (Hunt LNG Operating Company) Listed by coinbasecartel Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 23, 2026, the coinbasecartel ransomware group listed Hunt LNG Operating Company on its leak site in connection with Peru LNG operations. The listing states that internal files were exfiltrated during a ransomware attack. The number of individuals whose information may be involved remains unknown, as do the precise volume of data and the timeline of the intrusion. This incident matters because the affected organisation handles operational records tied to energy infrastructure and international exports. Any confirmed exposure of internal documents could affect business partners, contractors or employees whose details appear in those files.

Breaking down the breach

The only confirmed detail is the April 23, 2026 listing itself. The group asserts that files were taken during a ransomware operation, yet no independent confirmation of the exfiltration or encryption has been made public. Scale, entry method and duration of access are not disclosed in available reporting.

The group behind it: coinbasecartel

Coinbasecartel is a ransomware operator that follows the common pattern of encrypting systems and copying data before demanding payment. The group maintains a leak site where it lists organisations it claims to have targeted, using the listings to pressure victims. Public records show the actor has appeared in multiple incidents across different sectors, typically publishing file samples or directory listings to support its claims. In this case the group claims responsibility for the Hunt LNG listing, but that claim has not been independently verified.

Who is Hunt LNG Operating Company?

Hunt LNG Operating Company manages the Peru LNG facility at Pampa Melchorita, which processes natural gas from the Camisea fields for liquefaction and export. The organisation sits within Peru’s hydrocarbon sector and maintains records related to plant operations, supply contracts, regulatory compliance and workforce administration. A breach at such a facility is consequential because internal files can contain details about critical infrastructure, commercial agreements and personnel.

The information in question

The listing refers only to “internal files exfiltrated in ransomware attack.” No further breakdown of file categories or data fields has been released. Organisations of this type routinely hold operational logs, contract documentation, employee records and technical specifications; however, the exact contents of the claimed exfiltration remain unconfirmed.

What's at stake

Exposed internal files could reveal commercial relationships, technical configurations or personal information of staff and contractors. For individuals, the main risks involve misuse of contact details or employment records for targeted phishing or identity-related fraud. For the organisation, the exposure may complicate regulatory reporting and ongoing commercial negotiations without necessarily indicating operational disruption.

If your data was in this claimed breach

Individuals can begin by reviewing account statements and credit reports for unusual activity. Changing passwords for any work-related or linked personal accounts and enabling multi-factor authentication reduces further exposure. Organisations in similar sectors routinely advise staff to treat unexpected messages with caution.

• Review recent account activity for signs of unauthorised access
• Enable multi-factor authentication on email and financial accounts
• Run a free exposure scan of your email address against known breach data
• Monitor official statements from Hunt LNG Operating Company for further guidance

AICompiled with AI assistance from public sources and published under our editorial standards.