SBC Global, Bitfinex, Coinmama, and Rutgers University Part 2 Leak Listed by flocker Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations across finance, technology and education by claiming data theft and threatening public leaks when ransoms go unpaid. Listings on criminal leak sites have become a routine part of that pressure, even when independent confirmation of the underlying intrusion remains limited.

On 5 May 2024 the ransomware group flocker listed SBC Global, Bitfinex, Coinmama and Rutgers University together under a single “Part 2 Leak” entry, asserting that internal files had been taken after the organisations refused to pay. Public detail on the scale of any compromise and the precise contents of the files remains limited, yet the claim itself places the named entities and anyone whose data they hold under renewed scrutiny.

What happened

According to the leak-site notice dated 5 May 2024, flocker presented SBC Global, Bitfinex, Coinmama and Rutgers University as the four victims of a single ransomware attack. The group stated that the organisations “refused to pay” and that internal files had been exfiltrated. No further technical details—such as the date of initial access, the number of systems involved, or the volume of data taken—have been disclosed in the public record. The number of people potentially affected is unknown. The listing itself constitutes an unverified claim by the threat actor; independent confirmation of the intrusion or of the data’s authenticity has not been reported.

Inside flocker

Flocker is a ransomware operation that follows the now-common double-extortion model: encrypting systems while simultaneously copying data and threatening to publish it if a ransom is not paid. Like many such groups, it maintains a dark-web leak site where it posts victim names, sample files and countdown timers. Public reporting has previously associated flocker with opportunistic targeting of organisations that hold commercially or personally sensitive information, often after initial access through phishing, exposed remote services or unpatched software. The group’s communications typically emphasise the refusal to pay as justification for releasing stolen material. In the present case, the only statements attributed to flocker are those appearing on its leak site: that the four named entities were attacked, that payment was refused, and that internal files were taken. No additional claims specific to this incident have been verified.

SBC Global, Bitfinex, Coinmama, and Rutgers University Part 2 Leak and its sector

The four organisations span distinct sectors. Bitfinex and Coinmama operate in cryptocurrency exchange and brokerage services, handling customer accounts, transaction records and identity-verification data. Rutgers University is a major public research institution that maintains student, faculty and research records. SBC Global is a telecommunications and internet-services provider whose systems typically contain subscriber account information and network-related data. Collectively they process large volumes of personal, financial and operational information. A successful ransomware intrusion against any of them can therefore expose material that is valuable both for financial fraud and for further social-engineering attacks. Because the leak-site entry treats the four as a single “Part 2 Leak,” the precise relationship among the claimed compromises—if any—remains unconfirmed.

What was likely exposed

The only data type named in the public listing is “internal files exfiltrated in ransomware attack.” Exact file names, record counts or categories of personal information have not been disclosed. Organisations of these types ordinarily hold:

• customer or student account identifiers, contact details and authentication credentials;
• financial or transaction records, including cryptocurrency wallet addresses and payment histories;
• internal operational documents, network diagrams and employee information;
• research or proprietary data in the case of a university.

Whether any of those categories were among the files claimed by flocker cannot be confirmed from available information. Readers should treat the precise contents as unconfirmed.

What's at stake

If the claimed files contain personal or financial data, individuals face the ordinary risks of identity theft, targeted phishing and unauthorised account access. Cryptocurrency customers may see increased attempts to drain wallets or to social-engineer recovery credentials. University affiliates could encounter misuse of academic or personal records. For the organisations themselves, the listing creates reputational pressure, potential regulatory scrutiny and the operational cost of investigating and containing any actual intrusion. Because the number of affected people is unknown and the data types remain unspecified, the concrete impact cannot yet be quantified; the risk is real but still unmeasured.

Were you affected?

Anyone who holds an account with Bitfinex or Coinmama, is affiliated with Rutgers University, or has been a customer of SBC Global should monitor account activity and enable strong multi-factor authentication where available. Watch for unexpected password-reset messages or requests for sensitive information. Consider placing fraud alerts with credit bureaus if financial data may be involved. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Public detail on this particular incident remains limited; further official statements from the organisations themselves will be the most reliable source of confirmation.

AICompiled with AI assistance from public sources and published under our editorial standards.