PT Perusahaan Jamu Air Mancur NEW Listed by Coinbase Cartel Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

A ransomware group has publicly named PT Perusahaan Jamu Air Mancur on its leak site, raising practical questions for anyone who has dealt with the company as a customer, employee, supplier, or partner. No independent confirmation of the claim has appeared as of writing, and the company has not publicly confirmed any incident. Still, listings of this kind matter because they can signal that personal or business information might later appear online, be sold, or be used in fraud attempts — if the claim has substance.

Public detail remains thin. The number of people who might be affected is unknown, and the listing does not spell out what, if anything, was taken. Readers should treat the situation as an unverified allegation and focus on sensible precautions rather than assuming their records are already exposed.

What is being claimed

According to a leak-site listing attributed to the group known as Coinbase Cartel, PT Perusahaan Jamu Air Mancur was newly listed on or around August 22, 2026. The listing frames the organisation in the pharmaceuticals and healthcare sector and associates a figure of $100 million with the entry. That figure appears as part of the group’s presentation; it is not an independently verified loss amount, ransom demand confirmation, or valuation of any stolen data.

The listing does not disclose how many people might be involved, what systems were supposedly accessed, when any intrusion allegedly occurred, or what method was used. Data types supposedly at issue are not disclosed in the material summarised here. Coinbase Cartel has listed the company on its leak site; that is a claim by the group, not a finding confirmed by the company, a regulator, or a neutral breach registry. As of writing, PT Perusahaan Jamu Air Mancur has not publicly confirmed the claim.

The group behind it: Coinbase Cartel

Coinbase Cartel is a name that has appeared in public reporting on ransomware and data-extortion activity. Groups operating under such brands typically claim to have stolen files, threaten to publish or auction them, and use dedicated leak sites to pressure organisations into paying. Their postings are marketing and leverage as much as evidence: listings can exaggerate scale, recycle older material, or name victims before any proof is shown.

Well-documented patterns for actors in this category include double-extortion style pressure — encryption paired with theft claims, or theft claims alone — and staged releases meant to increase urgency. None of that establishes what happened in this specific case. For PT Perusahaan Jamu Air Mancur, the only incident-specific assertion available in the given facts is that Coinbase Cartel has listed the company and described it in pharmaceuticals and healthcare terms with a $100 million figure attached to the listing. Anything beyond that listing remains unconfirmed.

About PT Perusahaan Jamu Air Mancur

PT Perusahaan Jamu Air Mancur is an Indonesian company associated with jamu and related traditional and commercial health products — a segment that sits at the intersection of consumer goods, herbal or pharmaceutical-style manufacturing, and healthcare-adjacent commerce. Organisations in this sector commonly maintain relationships with distributors, retailers, clinics or outlets, employees, and end customers across a wide geography.

A leak-site claim against a firm in this space is consequential not because negligence has been proven — it has not — but because the sector routinely handles information that outsiders could misuse if it were ever copied: contact and account details, order or supply-chain records, workforce data, and sometimes health- or product-related correspondence. A listing does not prove those categories were taken here; it only explains why people connected to the company pay attention when a group names the firm in public.

The information in question

The facts available for this listing state that data types named as exposed are not disclosed. There is no verified inventory of files, databases, or record counts. It would be inaccurate to assert that any particular category — names, national ID numbers, medical notes, payment cards, formulas, or otherwise — was stolen.

If files from a pharmaceuticals and healthcare-related manufacturer and brand of this kind were ever taken, organisations in the sector typically hold some mix of customer and reseller contact data, order and logistics records, employee and payroll-related information, supplier contracts, quality or regulatory documentation, and internal business correspondence. That is a description of common industry holdings, not a statement of what Coinbase Cartel obtained. Exact contents in this matter remain unconfirmed, and the group’s own descriptions, when they appear on leak sites, function as attacker claims rather than audited inventories.

The real-world impact

For individuals, the conditional risk is familiar: if personal details were copied and later published or traded, they could be used for phishing, account takeover attempts, loan or SIM-related fraud, or targeted scams that reference a real company relationship to sound credible. Healthcare-adjacent branding can make social-engineering messages feel more urgent. None of that means a given person’s data is already out; it describes how criminals often exploit breach claims and dumps when they do obtain usable records.

For the organisation, an unconfirmed listing still creates reputational pressure, possible regulatory and partner questions, and the operational burden of investigating and communicating under uncertainty. Customers and counterparties may seek reassurance; suppliers may tighten access. Impact scales with whether any exfiltration actually occurred and what was involved — facts that are not established in the public material summarised here. People affected, if any, are listed as unknown.

Steps worth taking either way

Treat the Coinbase Cartel listing as a prompt for hygiene, not as proof that your information has already been published. If you have an account, loyalty profile, or ongoing business relationship with PT Perusahaan Jamu Air Mancur, use unique passwords, enable multi-factor authentication where available, and be wary of unexpected messages that cite a “data incident,” demand urgent payment, or ask you to open attachments or re-enter credentials on unfamiliar pages. Prefer official channels you already trust rather than links in cold emails or chats.

Monitor bank and mobile-money activity for unfamiliar transactions, and be cautious with unsolicited calls or messages that pressure you for one-time codes or identity documents. Employees and contractors can follow their organisation’s internal guidance on credential resets and phishing reporting if such guidance is issued. Because the listing does not confirm what was taken — or that anything was taken — these steps are precautionary.

Readers who want a concrete next check can run a free exposure scan of their email address against known breach datasets to see whether that address has already appeared in unrelated, previously documented incidents. That kind of scan does not prove or disprove this particular claim; it only helps you see whether your email is already circulating in older public breach material and whether tighter password and recovery practices are overdue.

AICompiled with AI assistance from public sources and published under our editorial standards.