Coinbase Cartel Shifts to Data-Theft-First Tactics, Targeting High-Value Industries

Coinbase Cartel is a fast-rising data-extortion group observed since September 2025 that emphasizes rapid data theft and publication threats rather than widespread encryption, claiming 60+ victims across industries (notably healthcare, technology, and transportation). The group leverages social engineering, initial-access brokers, and compromised admin credentials to exfiltrate valuable data, operates a leak site and auction pages to pressure victims into Bitcoin payments with tight deadlines, and presents a significant operational risk that requires defenders to prioritize MFA, least privilege, fast patching, data inventory, logging/auditing, and MDR.