www.coconutboard.gov.in Listed by tengu Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

The listing of www.coconutboard.gov.in by the tengu ransomware group on 20 January 2026 forms part of a continuing pattern in which threat actors target public-sector and agricultural organisations. Such incidents occur amid widespread use of ransomware that combines data encryption with claims of exfiltration, often followed by listings on dedicated leak sites. Public records confirm only that internal files were stated to have been taken; the number of individuals affected and the precise contents remain undisclosed.

What happened

The Coconut Development Board site was listed by the tengu group on 20 January 2026. The sole technical detail released states that internal files were exfiltrated during a ransomware attack. No figure for the volume of data, the number of records, or the date of the intrusion has been made public. The organisation has not issued an independent confirmation of the claims.

The group behind it: tengu

Tengu is a ransomware operation that maintains a leak site where it lists organisations it claims to have compromised. Groups of this type typically gain initial access through phishing, exposed remote services or supply-chain weaknesses, then move laterally before deploying encryption and copying selected files. Their public listings serve as a pressure tactic in double-extortion schemes. In this case the group claims www.coconutboard.gov.in as a victim; independent verification of the data or the intrusion method has not been published.

www.coconutboard.gov.in and its sector

The Coconut Development Board is an Indian government body responsible for promoting coconut cultivation, processing and related industries. It administers schemes for farmers and producer companies, supports technology adoption and facilitates domestic and export markets for products such as virgin coconut oil and desiccated coconut. Entities in this sector routinely hold records on registered growers, scheme participants, financial disbursements and technical data on processing facilities.

What was likely exposed

The only confirmed statement is that internal files were allegedly exfiltrated. The exact categories of information contained in those files have not been disclosed. Organisations of this type commonly store farmer registration details, subsidy and scheme records, contact information and operational documents; whether any of these categories are present in the claimed exfiltration cannot be confirmed from available information.

What's at stake

Individuals whose details appear in government agricultural records may face risks of targeted fraud or unwanted contact if the files contain personal identifiers. The board itself may experience operational disruption and loss of internal planning material. Because the scale and sensitivity of the data remain unknown, the practical consequences for any specific person or programme cannot yet be quantified.

What to do if you're exposed

Anyone who has interacted with the Coconut Development Board or similar schemes should monitor their email and financial accounts for unusual activity. Official guidance from Indian government cybersecurity bodies recommends changing passwords, enabling multi-factor authentication and reporting suspected misuse to local cyber-crime portals.

• Review bank and scheme statements for unauthorised transactions
• Enable multi-factor authentication on all government and financial portals
• Run a free exposure scan of your email address against known breach data
• Report confirmed misuse to the appropriate authorities

AICompiled with AI assistance from public sources and published under our editorial standards.