GoTip data allegedly leaked by RansomEXX

• Ransomware group: RansomEXX
• Country: Japan
• Sector: Professional Services
• Announcement date: April 17, 2026

RansomEXX claims to have stolen data from GoTip

The ransomware group known as RansomEXX has listed a data breach on its leak site, claiming to have targeted the Japanese platform GoTip. According to the announcement, the group has published 1.13 GB of data that they allege belongs to the organization. This type of activity is characteristic of double extortion tactics, where threat actors not only encrypt an organization's systems but also threaten to release sensitive information on public leak sites to increase pressure for ransom payments.

The threat actor claims the incident occurred on April 16, 2026, and the announcement was made on April 17, 2026. In the leak announcement, the group alleges that the organization shows little regard for the security of its users' personal data. While the group has made a portion of the data publicly available, information regarding the specific identity and background of this group remains limited.

Details of the alleged data leak

The breach involves what the group claims are database backups belonging to the GoTip platform. Based on SQL code samples provided in the leak announcement, the stolen information is quite extensive. The data reportedly includes a variety of sensitive personal and financial information that could be used for malicious purposes.

The affected data types identified in the leak include:

• User credentials
• Email addresses
• Phone numbers
• Address data
• Payment system data
• Social media account information

Furthermore, the leaked data may include names, dates of birth, gender, and physical addresses. The announcement also indicates that the data contains social media IDs and information associated with the Stripe payment system. Additionally, there is a possibility that credentials and financial connection details belonging to manager accounts may be included in the leaked data.

About GoTip

GoTip is a Japanese live-streaming enhancement tool designed to increase interactivity for content creators. The platform allows streamers to connect digital tips to physical, Bluetooth-enabled devices. This enables viewers to support creators by sending tips that trigger specific physical actions on the creator's devices, making live streams more engaging and interactive.

Impact and security implications

The exposure of such a diverse range of data carries significant risks for both the organization and its users. Given the nature of the leaked data, GoTip users may face an increased risk of identity theft and targeted phishing attacks. The inclusion of payment system data and Stripe connection details is particularly concerning, as it could compromise user payment security and lead to secondary fraud attempts.

From a regulatory and legal perspective, the organization may be subject to data breach notification requirements under Japan's Act on the Protection of Personal Information (APPI). Beyond legal compliance, the disclosure of the corporate database structure could provide a roadmap for attackers, potentially guiding them in future incidents and resulting in significant reputational damage for the organization.

For organizations operating in the professional services and digital tool sectors, such incidents highlight the necessity of robust security frameworks. Common defensive steps include implementing strong encryption for data at rest and in transit, enforcing multi-factor authentication (MFA) for all user and administrative accounts, and maintaining strict access controls. Additionally, regular security audits and the implementation of comprehensive monitoring systems can help detect unauthorized access to database backups before large-scale exfiltration occurs.