ATG listed on coinbasecartel leak site

• Ransomware group: coinbasecartel
• Country: Sweden
• Sector: Retail & E-Commerce
• Announcement date: December 12, 2025

The Swedish organization ATG has been listed on a leak site operated by the threat group known as coinbasecartel. According to an announcement made on December 12, 2025, the threat actor claims to have successfully targeted the organization and obtained data belonging to the entity.

The claims made by coinbasecartel

The incident was officially announced by the coinbasecartel group on December 12, 2025. In their public communication, the threat actors allege that they have gained unauthorized access to the organization's systems and have exfiltrated data. As part of their announcement, the group further claims to have released sample files to demonstrate the validity of their breach.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms through a tactic known as double extortion. In these scenarios, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. While the presence of a listing on a leak site is a significant indicator of a potential security incident, it is important to note that these claims are made by the threat actors themselves.

Details regarding the alleged data breach

The information provided by the threat group regarding the specifics of the stolen data remains limited. While the group has released an announcement, they have not provided detailed information regarding the specific contents of the files they claim to have stolen. The available evidence, such as screenshots provided by the group, displays a structure that resembles file directories of the allegedly exfiltrated data; however, no specific details regarding the contents of these directories have been made available to the public.

The listing does not name any specific data types that have been compromised. Furthermore, there is no information available regarding the total size of the data stolen or the specific number of files involved in the breach. Additionally, no ransom demand has been publicly disclosed in connection with this specific listing.

About ATG

ATG (Aktiebolaget Trav och Galopp) is a state-owned gaming company based in Sweden. Established in 1974, the organization serves as the primary operator of the horse racing betting market in Sweden. Their operations include horse racing and various other betting games, making them a significant entity within the Swedish gaming and retail sector.

Potential impacts and organizational security

This incident may create a negative impact on the organization's data security processes. The alleged data breach could lead to secondary risks for the organization's customers, such as identity theft and targeted phishing attacks. Because the organization operates within Sweden, a potential data breach may result in legal sanctions under the General Data Protection Regulation (GDPR).

The threat group involved, coinbasecartel, has limited information available in the public domain, which adds a layer of uncertainty to the situation. For organizations in the retail and e-commerce sectors, such incidents can place significant pressure on operational continuity and customer trust. To mitigate such risks, organizations typically focus on robust defensive measures, such as implementing multi-factor authentication, maintaining regular offline backups, and conducting frequent security audits to identify vulnerabilities before they can be exploited by threat actors.

Summary of risks

• Potential for identity theft targeting customers
• Risk of targeted phishing attacks
• Potential legal sanctions under GDPR
• Pressure on operational continuity
• Impact on customer trust