Amcor listed on coinbasecartel leak site following alleged data breach

• Ransomware group: coinbasecartel
• Country: Australia
• Sector: Manufacturing
• Announcement date: November 25, 2025

The global packaging leader Amcor has been listed on a leak site operated by the threat actor group known as coinbasecartel. The announcement, which appeared on November 25, 2025, involves an alleged data breach targeting the organization's digital infrastructure.

The alleged incident involving coinbasecartel

According to the announcement made by coinbasecartel, the group claims to have successfully executed an attack against Amcor, resulting in a data breach. The claim was officially posted to the group's leak platform on November 25, 2025, which coincides with the date the group identifies as the claimed attack date. This type of activity is characteristic of modern ransomware operations, where threat actors often employ double extortion tactics. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also exfiltrate sensitive information to use as leverage in ransom negotiations.

The listing serves as a public notification from the threat actor, signaling that they have obtained data belonging to the target. While these claims are a common method used by ransomware groups to pressure organizations into paying ransoms, the specific details regarding the breach remain limited to the group's initial announcement on their platform.

Details regarding the claimed stolen data

At this stage of the incident, the specific nature and content of the leaked information remain unclear. The coinbasecartel group has not provided detailed descriptions regarding the types of files or the specific categories of data that were allegedly compromised during the attack. Furthermore, the listing does not specify the total volume of the data stolen or the number of files involved in the breach.

The listing names no specific data types that have been affected by this incident. Visual evidence provided by the group, such as screenshots, does not offer clarity, as the content of the data appears to be blurred or is otherwise not clearly specified. Consequently, the exact scope of the information at risk remains unknown to the public and the organization.

About Amcor

Amcor is a global leader in developing and producing packaging solutions for a wide range of industries. The company's diverse portfolio serves sectors including food, beverage, pharmaceutical, medical device, and personal care products. Amcor specializes in sustainable packaging technologies, maintaining a significant presence in the global manufacturing landscape.

Potential impact and organizational considerations

This incident may create a negative impact on the organization's operational processes and could lead to significant reputational damage. Depending on the nature of the leaked data, there are potential risks such as identity theft or the execution of targeted phishing campaigns directed at employees or customers. For an organization based in Australia, a potential data breach may trigger legal obligations under the Australian Privacy Act, necessitating specific regulatory responses and notifications.

In the manufacturing sector, such incidents highlight the importance of robust cybersecurity frameworks. Organizations in this sector often implement defensive measures such as network segmentation, multi-factor authentication, and continuous monitoring to protect intellectual property and supply chain integrity. Because information regarding the coinbasecartel group is limited, no definitive assessment can be made regarding the group's specific motivations or their technical methods of entry.

General defensive strategies for organizations

To mitigate the risks associated with ransomware and data exfiltration, organizations typically focus on several key areas:

• Data encryption: Ensuring that sensitive data is encrypted both at rest and in transit to render stolen information useless to attackers.
• Access control: Implementing the principle of least privilege to ensure that users only have access to the data necessary for their roles.
• Regular backups: Maintaining offline or immutable backups to allow for recovery in the event of a ransomware encryption event.
• Employee training: Conducting security awareness programs to help staff recognize and avoid phishing attempts, which are often the initial vector for such attacks.