Coinbasecartel Claim Names Demand.io in Ransomware Extortion

Summary

A ransomware.live record lists Demand.ioNEW (also referred to as Demand.io in the text) as the target of a coinbasecartel claim, citing a leak-site entry and demanding payment under threat of data disruption. The claim is unconfirmed.

Key points

• The record lists Demand.ioNEW as the victim; accompanying text refers to Demand.io.
• The claim is attributed to the coinbasecartel ransomware actor.
• The claim demands payment under threat of data disruption.
• A coinbasecartel leak-site entry is cited, and ransomware.live is identified as the monitoring service.
• The post says the claim is unconfirmed; no independent evidence of compromise is provided.

Threat Actors

Industries

Related Articles

• Authorities Seize Virtualine Domain Used by Cybercriminalscyberscoop.comCoinbase Cartel
• CYFIRMA Report Tracks January 2026 Ransomware Trends and Tacticsgithub.com/jacobdjwilsonCoinbase Cartel
• CYFIRMA Reports 1,046 Ransomware Victim Claims in August 2026, Up 18.2%github.com/jacobdjwilsonCoinbase Cartel
• Ransomware Disclosures Fell to 862 in September as Affiliates Continued Evolving Their Tacticscyfirma.comCoinbase Cartel