Coinbase Cartel 2026 activity
Extortion group. 5 reports in 3 countries: 0 confirmed, 5 claimed or disputed. Latest 22 Aug 2026.
Indonesia · 
Philippines · 
Vietnam
🎯 What sources say
- Indonesia: Data-extortion listings against KemenPPPA, the agriculture ministry, BPR Bintan, Jamu Air Mancur and others in 2026. ransomware.live ransomware.live
- Vietnam: Data-theft group without an encryptor that listed Pacific Airlines in January 2026. ransomware.live
🚨 Reports
| Organisation | Country | Date | Sector | Type | Actor | What happened | Sources |
|---|---|---|---|---|---|---|---|
| ⚠️ ClaimedPT Bank Perekonomian Rakyat Bintan | Indonesia | 22 Aug 2026 | Finance | Ransomware | Coinbase Cartel | Claimed. CoinbaseCartel listed the rural bank on its leak site. | ransomware.live✓ 7 Nov |
| ⚠️ ClaimedLifeBank Microfinance Foundation | Philippines | 22 Aug 2026 | Finance | Ransomware | Coinbase Cartel | Claimed. Coinbase Cartel listed LifeBank Microfinance Foundation on its leak site on 22 August. | Ransomware.live (Philippines)✓ 7 Nov |
 ⚠️ ClaimedKementerian Pertanian | Indonesia | 23 Apr 2026 | Government | Data leak | Coinbase Cartel | Claimed. CoinbaseCartel listed the Ministry of Agriculture on its leak site; no leak size was given. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedKementerian Pemberdayaan Perempuan dan Perlindungan Anak (KemenPPPA) | Indonesia | 15 Apr 2026 | Government | Ransomware | Coinbase Cartel | Claimed. CoinbaseCartel listed the women's empowerment and child protection ministry on its leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedPacific Airlines | Vietnam | 29 Jan 2026 | Transport | Data leak | Coinbase Cartel | Claimed. Coinbase Cartel, a data-theft extortion group, listed the Ho Chi Minh City-based carrier on 29 January 2026. | ransomware.live✓ 7 Nov |
Leak-site listings are claims until the organisation or authorities confirm them. Methodology