Plug Power Listed by coinbasecartel Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 15 September 2025, Plug Power appeared on a listing by the coinbasecartel ransomware group, which claims to have taken internal files during a ransomware attack. For employees, contractors, partners or anyone whose details might sit inside those files, the practical stakes are straightforward: personal or work-related information could be exposed, sold or used for further fraud if the claim proves accurate. Public detail remains limited, so the exact reach is still unknown, yet the listing alone is enough to warrant careful attention from people connected to the company.

What is known so far is narrow. The number of people affected has not been disclosed, and the precise contents of the files have not been independently verified. Still, any organisation that handles hydrogen-fuel-cell projects and clean-energy contracts typically holds employee records, supplier contacts and operational documents; those categories are the ones most often at risk when internal files are taken.

What happened

According to the available record, Plug Power was listed by the coinbasecartel ransomware group on 15 September 2025. The group asserts that internal files were exfiltrated as part of a ransomware attack. No public confirmation has been issued by Plug Power itself, and no independent forensic report has been released that would verify the claim, the volume of data or the exact date the intrusion began. The number of people affected is listed as unknown. Method of initial access, duration of the intrusion and any ransom demand remain undisclosed. In short, the public picture rests on the group’s leak-site entry and the sparse accompanying description that internal files were taken.

Inside coinbasecartel

Coinbasecartel is a ransomware operation that has appeared repeatedly on public leak sites in recent years. Like many groups in this category, it typically follows a double-extortion model: encrypting systems while also copying data, then threatening to publish the material if payment is not made. The group posts victim names and sample claims on its dedicated site, a tactic intended to increase pressure. Public reporting has linked it to attacks across multiple sectors, though each listing is treated by investigators as an unverified claim until the victim or a third party states it. In the present case the group claims Plug Power’s internal files were exfiltrated; no further statements attributed specifically to this incident have been made public beyond that listing.

Who is Plug Power?

Plug Power designs and supplies hydrogen fuel-cell systems used in material-handling equipment, stationary power and other clean-energy applications. The company operates in the broader renewable-energy and industrial-technology sector, serving logistics firms, manufacturers and energy customers that are shifting away from fossil fuels. Organisations of this type routinely hold employee personnel files, contractor agreements, technical drawings, customer contracts and financial records. A breach involving internal files therefore carries weight not only for the company’s commercial position but also for the individuals whose personal or professional data may be among those documents. Because Plug Power works with partners across supply chains, any exposed material could also affect third parties who never dealt directly with the firm.

What data was at risk

The only data type named in the public record is “internal files exfiltrated in a ransomware attack.” No inventory of those files has been released, so the exact contents remain unconfirmed. Companies in the hydrogen and fuel-cell sector typically store employee contact details, payroll information, health or benefits records, supplier invoices, project specifications and correspondence. It is reasonable to expect that some combination of those categories could be present, yet it would be inaccurate to state that any specific type of personal data has been confirmed as exposed. Until a fuller disclosure appears, the safest description is that internal corporate files are claimed to have been taken and that the precise mix of personal versus purely operational material is still unknown.

The real-world impact

For individuals, the main risks are secondary misuse: phishing that references genuine internal details, identity fraud if personal identifiers were included, or targeted social-engineering attempts against employees and partners. Because the scale is undisclosed, it is impossible to say how many people face elevated risk. For Plug Power the consequences include potential regulatory scrutiny, contractual notifications to customers and suppliers, and the operational cost of investigating and containing the incident. Even if the files prove to be largely technical rather than personal, the mere fact of an unauthorised copy can erode trust and invite further probing by other opportunistic actors. None of these outcomes is guaranteed; they are the ordinary downstream effects that follow when a ransomware group claims to hold internal material.

If your data was in this claimed breach

If you have worked for, contracted with or supplied Plug Power, treat the listing as a prompt to review your own exposure. Change passwords on any accounts that used a Plug Power email address, enable multi-factor authentication where it is available, and watch bank and credit statements for unfamiliar activity. Consider placing a fraud alert with the major credit bureaus if you believe personal identifiers may have been involved. You can also run a free exposure scan of your email address to check whether that address has already appeared in other known breach data sets; such a scan will not confirm or deny presence in this specific incident, but it can surface earlier exposures that deserve attention. Keep records of any suspicious contact that references Plug Power projects or personnel, and report them to the company and to the appropriate authorities if fraud is attempted.

AICompiled with AI assistance from public sources and published under our editorial standards.