GDEV listed on coinbasecartel leak site

• Ransomware group: coinbasecartel
• Country: Germany
• Sector: Technology
• Announcement date: December 12, 2025

GDEV listed by coinbasecartel

The technology company GDEV has been listed on the leak site of the threat actor known as coinbasecartel. This announcement, made on December 12, 2025, involves a claim that data belonging to the organization has been compromised by the group.

Details of the claim

On December 12, 2025, the group identified as coinbasecartel published a listing for GDEV on its dedicated leak site. According to the claim made by the threat actor, the organization's data has been successfully compromised. At this stage, public information regarding the specific identity and operational methods of the coinbasecartel group remains limited, making it difficult to ascertain the full scope of their typical activities.

In many modern cyberattacks, threat actors utilize leak sites to exert pressure on their victims. These sites often serve as a platform for double extortion, a tactic where attackers not only encrypt an organization's internal systems but also steal sensitive information. The threat actors then threaten to publish this stolen data on these public platforms unless a ransom is paid. This method aims to maximize leverage by threatening the victim's reputation and regulatory standing.

Data involvement

The nature of the leaked or compromised data has not been specified by the threat actor. The provided information and screenshots do not contain any details regarding specific data types, file counts, or the total size of the alleged exfiltration.

• No specific data types were named in the listing.

About GDEV

GDEV is an international gaming and entertainment company focused on growing and enhancing its portfolio of gaming studios. The company is listed on the Nasdaq and operates a diverse range of game development studios across its various holdings.

Potential impact and organizational implications

This claim may lead to disruptions in the organization's operational processes. If a data breach has occurred, the organization may face legal obligations under the European Union's General Data Protection Regulation (GDPR). The regulatory landscape for data protection is stringent, and organizations must navigate complex compliance requirements when sensitive information is potentially exposed.

Should the data be published, secondary risks may emerge, such as identity theft and targeted phishing attacks against employees or users. Furthermore, negative impacts on the organization's commercial reputation may be observed, which could potentially lead to a decline in stakeholder trust. Maintaining trust is a critical component of the gaming and entertainment sector, where user engagement and brand integrity are paramount.

When facing such claims, organizations typically focus on several defensive and investigative steps. These include conducting thorough forensic investigations to confirm the breach, implementing enhanced monitoring across the network, and reviewing access controls. Strengthening security posture often involves regular patching of vulnerabilities, employee awareness training to prevent phishing, and ensuring robust backup strategies are in place to mitigate the impact of encryption-based attacks.