The Epoch Times Listed by coinbasecartel Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Inside the incident

The listing appeared on April 15, 2026. The only confirmed detail is that internal files were taken during a ransomware attack. No information has been released on the timing of the intrusion, the volume of data involved, the method of initial access, or whether any systems were encrypted.

Scale remains undisclosed. The organization has not issued a public statement confirming or denying the claims, and no independent verification of the data’s contents or scope has been made available.

Inside coinbasecartel

Coinbasecartel is a ransomware operator that publishes victim names on a leak site when negotiations fail or to increase pressure. The group’s typical pattern involves data exfiltration followed by public listing of targeted organizations. Its listings constitute claims by the group rather than independently confirmed events.

In this case the group claims The Epoch Times as a victim through its leak-site posting. No additional statements or evidence from the group about the specific operation have been documented in public reporting.

The Epoch Times and its sector

The Epoch Times is an American media company founded in 2000. It publishes print and digital news content in multiple languages and operates across numerous countries, with its primary base in the United States. Media organizations routinely hold subscriber records, contributor information, internal editorial documents, and operational correspondence.

A breach at a news outlet can expose both personal data of readers and staff and internal materials that reveal sourcing or editorial processes. The sector’s reliance on digital distribution and audience data makes such incidents relevant to privacy and operational continuity.

What was likely exposed

The only detail released is that internal files were allegedly exfiltrated. Specific data types have not been disclosed. Organizations of this kind commonly store subscriber contact details, payment records, employee information, and editorial files, but the exact contents in this instance are unconfirmed.

• Subscriber and reader contact information (unconfirmed)
• Employee or contributor records (unconfirmed)
• Internal editorial or operational documents (unconfirmed)

The real-world impact

Individuals whose information appears in the exfiltrated files face the standard risks associated with leaked contact or account data, such as increased phishing or account takeover attempts. The organization may face costs related to investigation, notification, and remediation.

Because the number of affected people and the precise data categories remain unknown, the full scope of potential harm cannot yet be assessed.

Were you affected?

Check any communications from The Epoch Times for official notifications. Monitor accounts linked to the organization for unusual activity and enable multi-factor authentication where available. Readers can run a free exposure scan of their email address against known breach data to determine whether their information has appeared in public listings.

AICompiled with AI assistance from public sources and published under our editorial standards.