Twinsoft listed on coinbasecartel leak site

• Ransomware group: coinbasecartel
• Country: Greece
• Sector: Technology
• Announcement date: December 12, 2025

The technology company Twinsoft has been listed on the leak site of the threat actor known as coinbasecartel. On December 12, 2025, the group published an announcement claiming to have obtained data belonging to the organization.

The alleged incident

The threat actor known as coinbasecartel published an announcement on December 12, 2025, listing Twinsoft on their leak site. The group claims to have obtained data belonging to the organization. This listing suggests that a cybersecurity incident may have occurred within the operations of the company, which operates in the technology sector.

In modern cyberattack landscapes, ransomware groups often utilize leak sites to pressure victims. These sites serve as a public platform where threat actors announce their successful intrusions. Such tactics are frequently associated with double extortion, where attackers not only encrypt a victim's systems but also threaten to release sensitive information to the public to increase their leverage during ransom negotiations.

Details of the alleged data exfiltration

Regarding the specifics of the claim, the announcement on the leak site does not provide any specific information or sample files regarding the nature of the data allegedly exfiltrated. The listing does not specify the volume of data or the number of files involved.

Affected data types

• No specific data types were named in the listing.

Organization profile

Twinsoft is a technology company that develops specialized software solutions for the hospitality industry. It provides digital tools aimed at optimizing operational processes for businesses.

Risk assessment and industry implications

This situation may pose a potential risk to Twinsoft's customer data and trade secrets. As the organization is based in Greece, any potential data breach may fall under the scope of the EU General Data Protection Regulation (GDPR) and could lead to legal sanctions. The alleged leak may create grounds for secondary risks such as targeted phishing attacks or identity theft for the company's clients.

Information about this group is limited in the public domain. When an organization faces such a threat, it may need to conduct a comprehensive security audit of its systems to determine the extent of a potential data breach. Such audits are critical for identifying the entry point of the attacker and ensuring that vulnerabilities are patched to prevent future incidents.

For companies operating within the technology and hospitality sectors, maintaining robust cybersecurity posture is essential. This includes implementing multi-factor authentication, maintaining regular offline backups, and conducting continuous monitoring of network traffic. Because these organizations often handle sensitive operational data for various clients, the secondary risks of identity theft and phishing mentioned in this case highlight why comprehensive security measures are a necessity in the digital age.