Solarpro Holding listed on coinbasecartel leak site

• Ransomware group: coinbasecartel
• Country: Bulgaria
• Sector: Energy & Utilities
• Announcement date: December 12, 2025

Bulgarian energy company listed on threat actor leak site

Solarpro Holding, a prominent organization operating within the Bulgarian energy sector, has been listed on a leak site associated with the threat actor known as coinbasecartel. The announcement, which appeared on December 12, 2025, alleges that the group has successfully carried out a cyberattack against the company.

Details of the alleged attack

The threat actor known as coinbasecartel claimed to have gained unauthorized access to the systems of Solarpro Holding. This claim was made through an announcement on their dedicated leak site on December 12, 2025, the same date cited for the alleged attack. While the group has made these claims publicly, there is currently limited public information available regarding the specific identity, methods, or history of the coinbasecartel group.

Ransomware groups often utilize leak sites to exert pressure on their victims. These sites serve as a platform where threat actors post information about compromised organizations to shame them into paying a ransom. This tactic is frequently part of a broader strategy known as double extortion. In a double extortion scenario, attackers do not just encrypt a victim's data to disrupt operations; they also steal sensitive information and threaten to release it publicly if their demands are not met. This increases the pressure on the organization, as the threat of a data leak can lead to significant reputational damage and legal consequences.

Information regarding the alleged data breach

Despite the listing on the leak site, the announcement remains vague regarding the specifics of the incident. The group has not provided any specific information regarding the nature or the content of the allegedly leaked data. Furthermore, the data type field in the provided screenshot was left empty, and no information was provided regarding the volume of data or the number of files involved.

Potential risks and implications

The listing names no specific data types as being involved in the breach.

About Solarpro Holding

Solarpro Holding is a leading EPC contractor specializing in the design, construction, and integration of photovoltaic power plants. The company provides engineering, procurement, and construction services for solar energy projects, playing a significant role in the renewable energy infrastructure.

Sector analysis and potential consequences

The involvement of an organization operating in the energy sector introduces specific concerns. Because the energy sector is often considered part of a nation's critical infrastructure, a breach in this space may raise the possibility that the incident involves critical infrastructure data or sensitive operational information. Such data is highly valuable to threat actors and can be used to disrupt services or gain further access to interconnected networks.

If the alleged breach is confirmed, the organization may face several secondary risks. These include the potential for identity theft or targeted phishing attacks against the company's employees and business partners, as stolen credentials or personal information can be used to launch more sophisticated social engineering campaigns. Additionally, as an organization operating in Bulgaria, Solarpro Holding may be subject to legal obligations and administrative sanctions under the General Data Protection Regulation (GDPR) if a breach of personal data is verified.

To defend against such threats, organizations in the energy and utility sectors typically focus on robust security frameworks. This includes implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized system access, and conducting regular vulnerability assessments. Furthermore, because double extortion relies on the threat of data exposure, maintaining offline, immutable backups and implementing strong data encryption can be vital steps in mitigating the impact of a ransomware event.