Coinmama listed on flocker leak site following alleged data breach

• Ransomware group: flocker
• Country: Israel
• Sector: Financial Services
• Announcement date: May 6, 2024

Flocker claims to have breached Coinmama systems

The threat actor known as flocker has listed the cryptocurrency exchange Coinmama on its leak site, claiming to have successfully breached the organization's systems. According to the announcement made on May 6, 2024, the group alleges that the incident occurred on April 26, 2024. The group claims to have exfiltrated a significant volume of data, totaling approximately 2 TB, which reportedly includes 210,000 user records.

In the announcement, the threat actor has employed a tactic common in modern cyberattacks known as double extortion. This method involves not only encrypting an organization's data to disrupt operations but also stealing sensitive information to use as leverage. The flocker group has threatened to release the stolen data publicly if their specific demands are not met within a seven-day deadline. No information regarding the specific ransom demand has been provided by the group.

Alleged data and affected information

The information allegedly stolen during the claimed attack is highly sensitive, as it pertains to the financial activities and identities of the exchange's clientele. Based on the claims made by the flocker group, the stolen data includes the following types of information:

• User information
• Transaction histories

The scale of the alleged breach, involving 2 TB of data and hundreds of thousands of user records, suggests a significant potential impact on the privacy of the platform's users. However, it is important to note that the accuracy of these claims and the true scope of the data involved remain unverified and may only be clarified through official statements from the institution.

About Coinmama

Coinmama is a cryptocurrency exchange that provides services for users to purchase various cryptocurrencies. The platform supports a variety of payment methods, including credit cards, bank transfers, and Apple Pay. Founded in 2013, the company operates as a global provider of crypto asset trading services.

Implications and industry risks

This incident highlights the growing risks faced by entities operating within the financial services sector. Given the sensitive nature of the financial data involved, such a breach could significantly increase the risk of identity theft and financial fraud for the affected users. When financial institutions are targeted, the potential for secondary crimes following a data leak is high.

From a regulatory perspective, depending on the specific regions where an institution operates, a confirmed breach of this nature could lead to significant legal sanctions under relevant data protection regulations. Furthermore, the use of double extortion methods poses a severe threat to an organization's reputation. The public release of sensitive user data can undermine user trust and cause long-term damage to the institution's brand integrity.

In such scenarios, organizations typically focus on incident response, forensic investigation, and strengthening defensive postures. Common defensive strategies for companies in the financial sector include implementing robust multi-factor authentication, maintaining strict network segmentation, and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors. As public information regarding the flocker group remains limited, the situation remains an evolving threat landscape for digital asset service providers.