Checkmarx listed on lapsus$ leak site following alleged data breach

• Ransomware group: lapsus
• Country: United States
• Sector: Technology
• Announcement date: April 25, 2026

The lapsus$ ransomware group has listed the technology company CHECKMARX on their leak site, claiming to have gained unauthorized access to the organization's sensitive information. This announcement, made on April 25, 2026, follows an alleged attack that took place on April 24, 2026. While the group has made these claims publicly on their platform, the specific details regarding the volume of data or any ransom demands remain unknown.

The alleged attack by lapsus$

According to the claims made by the lapsus$ group, the threat actors successfully infiltrated the organization's systems. The group asserts that they have obtained access to the company's proprietary source code and various database credentials. Information regarding the specific identity and operational details of this group remains limited.

In many modern cyberattacks, ransomware groups utilize a tactic known as double extortion. This method involves not only encrypting an organization's data to disrupt operations but also stealing sensitive information to use as leverage. By threatening to leak stolen data on public leak sites, attackers aim to pressure organizations into paying ransoms to prevent the exposure of intellectual property or private data. Such leak sites serve as a public gallery for these stolen assets, often used to damage a company's reputation and increase the pressure on leadership.

The claimed data types

The information allegedly stolen by the threat actors is significant in nature. Although no screenshots were provided by the group to substantiate their claims, the listing specifies several categories of compromised data. The alleged breach involves the following items:

• Source code
• Employee database
• API keys
• Database credentials (including MongoDB and MySQL)

The exposure of such technical assets, particularly API keys and database credentials, represents a critical security concern. In a typical enterprise environment, these credentials act as keys to various services and data repositories. If these are compromised, they can potentially lead to secondary attacks or provide unauthorized access to other interconnected systems within the infrastructure.

About Checkmarx

Checkmarx is a cybersecurity company focused on securing the software development lifecycle. The organization provides specialized solutions in several critical areas, including static analysis, software composition analysis, and infrastructure security. As a provider of security tools, the integrity of their internal data and code is central to their operational mission.

Potential impact and security implications

This alleged leak may pose a significant risk to the organization's intellectual property and overall software security. The exposure of source code can provide attackers with a roadmap for finding further vulnerabilities, while the compromise of employee data might create a foundation for targeted phishing attacks against the staff. Such social engineering attempts often target specific individuals to gain further access to corporate networks.

Furthermore, because the organization is based in the United States, a potential data breach may be subject to various state laws and federal regulations regarding data protection and notification. If the claims made by the lapsus$ group are verified, negative impacts may be observed across the organization's customers and its broader supply chain.

For organizations operating within the technology and cybersecurity sectors, maintaining robust defensive postures is essential. Common defensive steps include implementing strict identity and access management (IAM) to limit the utility of stolen credentials, utilizing multi-factor authentication (MFA) across all services, and conducting regular audits of API permissions. Additionally, monitoring for unauthorized access to source code repositories and implementing comprehensive logging and alerting for database queries can help in the early detection of such incidents. Protecting the software supply chain is a critical component of modern security, as vulnerabilities in one provider can ripple through many downstream users.