coinbasecartel ransomware group lists JBS Brazil - We have 3TB of your data on its leak site

• Ransomware group: coinbasecartel
• Country: Brazil
• Sector: Agriculture and Food Production
• Announcement date: March 5, 2026

Coinbasecartel claims to have stolen 3TB of data from JBS Brazil

The threat group known as coinbasecartel has listed the Brazilian food production giant JBS Brazil on its leak site. According to the announcement, the threat actor claims to have successfully breached the organization's systems and obtained a massive volume of sensitive information. The listing, which appeared on the group's platform on March 5, 2026, marks a significant potential security incident for the multinational corporation.

Details of the alleged breach

The coinbasecartel group has published a claim stating that they have gained unauthorized access to the systems of JBS Brazil. To support their claims of a successful intrusion, the threat actors have provided various document samples as evidence on their leak site. These samples serve as a visual confirmation of the group's presence within the corporate environment.

The announcement was officially posted on the group's platform on March 5, 2026. While the group has asserted that they have secured a significant amount of information, they have not provided a detailed explanation regarding the full scope and nature of the data they have allegedly exfiltrated. The screenshots shared on the leak site show various corporate document samples, but the specific contents and the exact categories of the information remain unclear.

Data involved in the incident

The listing names no specific data types in a categorized list, though the group asserts the total volume of the stolen information is 3TB.

About JBS Brazil

JBS S.A. is one of the world's largest meat processing companies, headquartered in Brazil. It is a multinational food company primarily engaged in the production and processing of beef, poultry, and pork. As a major player in the global agriculture and food production sector, the company maintains extensive operations across multiple regions.

Potential risks and industry implications

This incident may pose potential risks to JBS Brazil's operational continuity and corporate reputation. Depending on the actual content of the alleged leaked data, the organization may face risks such as identity theft and targeted phishing attacks directed at employees or business partners. Furthermore, the organization may face legal obligations under Brazil's data protection legislation (LGPD).

This type of incident is often associated with double extortion tactics. In a double extortion scheme, threat actors do not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. The threat actors threaten to leak the stolen data on public forums if a ransom is not paid, thereby increasing the pressure on the victim. Such leaks, carried out via double extortion, could also negatively impact supply chain security, as the breach of a major producer can have cascading effects on partners and distributors.

Regarding the threat actor, public information about coinbasecartel is limited. In general, when organizations face such threats, they often focus on strengthening their defensive posture through enhanced monitoring, implementing strict access controls, and ensuring robust backup strategies to maintain operational continuity. For companies in the food production sector, maintaining the integrity of the supply chain and protecting corporate intellectual property is a critical component of cybersecurity management.