In just seven months, a cyber-extortion group calling itself CoinbaseCartel has built a target list of more than 160 organizations.
Its latest claimed victim: IT services giant Cognizant, whose customers are now receiving letters informing them that a breach on April 21, 2026 may have exposed their personal information, including Social Security numbers.
“While we have no reason to believe that your information was misused, we thought it prudent to make this notification,” Cognizant wrote in its letter to affected customers. “We deeply regret this incident and any inconvenience to you.”
The company said it has no evidence yet that the data has been misused, and that it is notifying people purely as a precaution.
How Coinbase Cartel Operates
First observed in September 2025, CoinbaseCartel doesn’t lock up computer systems the way traditional ransomware does — its currency is fear and exposure. The group steals sensitive data first, then threatens to publish or sell it unless a ransom is paid, giving victims just 48 hours to make contact and 10 days to negotiate before that threat becomes real.
That business model has proven effective and fast-moving.
A Global Footprint
Researchers tracking cybercrime placed CoinbaseCartel among the ten most active ransomware and extortion groups in both September and December 2025.
By April 2026, its cumulative victim count had passed 160, spread across 17 industry verticals — healthcare, technology, transportation, logistics, and more — and touching organizations across North America, Europe, Asia-Pacific, South America, and the Middle East.
Technology companies bear the major brunt of these attacks, accounting for 30.4% of all targets — nearly a third of every organization hit. Manufacturing follows at around 13%, while Business Services and Consumer Services each make up roughly 10% of victims.
