What happened
CoinbaseCartel, a data-theft extortion group active since September 2025, has claimed a new victim in the form of CEVA Logistics, a global logistics provider. The group posted the listing on its Tor-based leak site, asserting that it exfiltrated customer data from CEVA’s systems and is holding it for ransom. The attack window spans July through August 2026, with the leak site entry timestamped 28 August 2026.
The stolen data includes Steam customer records pulled from CEVA’s environment. Valve confirmed that CEVA held Steam customer data but did not have access to Steam passwords, Steam Guard codes, or payment information. The dataset covers order details, which is what makes this a phishing risk for customers who recently received high-value electronics. No physical theft has been reported yet, but customers should expect delivery-related scams in the coming days.
CoinbaseCartel’s modus operandi is pure data exfiltration—no encryption, no disruption. The group relies on infostealer logs (RedLine, Lumma, Vidar) for initial access and credential harvesting. By April 2026 it had claimed over 160 victims; the current count sits at 207 across 34 countries, with Technology leading the sector breakdown at 63 victims. The group has been active for roughly 11 months and has been ranked in the top ten most active extortion groups for both September and December 2025.
Technical details
CoinbaseCartel does not deploy its own malware on victim endpoints. Initial access and credential harvesting rely on infostealer logs—specifically RedLine, Lumma, and Vidar—purchased or shared through the group’s partnerships intake page. The infostealer captures browser credentials, form data, and saved passwords, which the group then uses to pivot into CEVA’s environment and pull Steam customer records.
The attack chain is a single-extortion model: no file encryption, no system disruption. The group exfiltrates the dataset and lists the victim on its Tor DLS under one of three statuses—Active, Leaking, or Leaked. The leak site runs at fjg4zi4opkxkvdz7mvwp7h6goe4tcby3hhkrz43pht4j3vakhy75znyd.onion, last visited 28 August 2026. A single YARA rule (coinbasecartel.yar) and one Tox IOC (58041B45371485934F798C77F2F9705DA735F28AC9EBA2A19B4C9DBAF462802B88E33CEF482A) are published for detection.
No CVE is assigned for this incident. The group’s TTPs map to MITRE ATT&CK techniques for File and Directory Discovery, Financial Theft, External Remote Services, User Execution via Malicious File, and Impair Defenses through Disable or Modify Tools. Phishing is handled via Spearphishing and Vishing, which is where the Steam order data becomes a delivery-scam vector for affected customers.
Who is affected
The CEVA Logistics breach is the latest in a run of 207 claimed victims across 34 countries, with Technology leading the sector breakdown at 63 targets. The group has been active since September 2025 and has been ranked in the top ten most active extortion groups for both September and December 2025. By April 2026 it had claimed over 160 victims; the current count sits at 207, with the CEVA entry timestamped 28 August 2026.
The stolen data covers Steam customer records pulled from CEVA’s environment. Valve confirmed CEVA held Steam customer data but did not have access to Steam passwords, Steam Guard codes, or payment information. The dataset includes order details, which is what makes this a phishing risk for customers who recently received high-value electronics. No physical theft has been reported yet, but customers should expect delivery-related scams in the coming days.
What to do
Defenders should start by hunting the infostealer logs that seeded the compromise. The group publishes a single YARA rule, coinbasecartel.yar, which covers the RedLine, Lumma, and Vidar variants it runs on victim endpoints. For endpoint detection, load the rule into your EDR or YARA scanner and scan for the Tox IOC 58041B45371485934F798C77F2F9705DA735F28AC9EBA2A19B4C9DBAF462802B88E33CEF482A in memory or on disk. The YARA rule and Tox hash are the only published IOCs, so add them to your threat feed and push them to endpoints that were active in the last 30 days.
For mitigation, rotate all credentials that passed through the infostealer—browser passwords, form data, and saved logins are all in the logs. Force a password reset for any user who logged in via the infostealer, and invalidate Steam Guard codes if the customer used the same browser. The group’s TTPs map to MITRE ATT&CK techniques for File and Directory Discovery, Financial Theft, External Remote Services, User Execution via Malicious File, and Impair Defenses, so check for disabled or modified security tools on the CEVA host. No CVE is assigned, so there’s no patch to apply—this is a data exfiltration, not a code vulnerability.
Valve confirmed CEVA held Steam customer data but did not have access to Steam passwords, Steam Guard codes, or payment information. That means the dataset is order data, which is why the phishing risk is real for customers who just got high-value electronics. Expect delivery-scam calls and messages in the next few days. The leak site is live at fjg4zi4opkxkvdz7mvwp7h6goe4tcby3hhkrz43pht4j3vakhy75znyd.onion, last visited 28 August 2026. If you’re not CEVA or a direct Steam customer, you’re not affected—this is a single-extortion model, no file encryption, no system disruption.
Key points
- CEVA Logistics was hit by a cyberattack in July–August 2026 that exposed Steam customer data.
- Valve confirms CEVA had access to Steam customer data but not Steam passwords, Steam Guard codes, or payment info.
- CoinbaseCartel is the suspected actor, having previously listed CEVA as a victim in September 2025.
- The group is a data-theft-only extortion outfit active since September 2025 with 178+ claimed victims.
- Affected Steam customers should watch for fake delivery calls, messages, and visitors.