ATG Listed by coinbasecartel Ransomware Group

On December 12, 2025, Swedish gaming company ATG appeared on the leak site of the coinbasecartel ransomware group in a listing claiming internal files were exfiltrated during a ransomware attack. The breach affects anyone whose personal data was stored in ATG’s systems, including customers who have placed bets, registered accounts, or shared contact details with the company that has operated in Sweden since 1974.

What's Publicly Reported from Reporting

Public reporting indicates that attackers gained access to ATG’s network, encrypted systems, and then exfiltrated internal documents before publishing a sample on their dark-web leak page. The exact number of people impacted remains unknown, as neither ATG nor the ransomware group has released a full data inventory. Available reporting describes the exposed material as internal files rather than a simple database dump, suggesting the breach could contain customer records, employee information, or operational data accumulated over decades of gaming and betting services.

December 12, 2025 marks the date the group listed ATG on its leak site hosted at an onion address. No public timeline has been confirmed for when initial access was obtained or how long the attackers remained inside the network prior to encryption and data theft.

Why This Matters for You and Your Family

When a gaming and betting company like ATG suffers a breach, the information exposed often includes names, addresses, email accounts, phone numbers, and payment details tied to real people and households. Criminals can use these records to attempt account takeovers on other services where you reuse the same credentials. For families this risk extends beyond the primary account holder: children’s gaming accounts, shared family emails, or linked payment methods can become entry points for further harassment or financial fraud.

Credential leaks like this one frequently cascade into broader identity theft because betting customers often register with the same email and password combination used for everyday services. Once criminals obtain even partial customer data from ATG, they can test those details across banks, email providers, and social platforms within hours.

The Doxxing and Identity-Chain Implications

Exposed internal files can accelerate doxxing by linking usernames, real names, home addresses, and gaming habits in one convenient package. Attackers routinely chain this information with data from previous breaches to build detailed profiles. A single leaked betting record can reveal family relationships, children’s usernames on gaming platforms, or location patterns that make targeted harassment or extortion far easier.

Public reporting on similar incidents shows that ransomware groups increasingly publish enough material to enable identity-chain attacks. Criminals map one handle to an email, the email to a phone number, and the phone number to physical addresses and family members. Gaming accounts belonging to children are especially vulnerable because parents often use household details during registration, creating direct links between adult customer data and minors’ online identities.

Coinbasecartel’s Publicly Known Track Record

Public reporting attributes the coinbasecartel group with emerging in recent years as a ransomware operation that targets companies in entertainment, finance, and technology sectors. The group is known for its dual extortion playbook: first demanding ransom to prevent data publication, then listing victims on its leak site when payment is refused. Notable prior victims include organizations whose customer or internal records appeared on the same onion domain now hosting ATG’s data.

Typical tactics involve initial access through phishing or exploited remote desktop services, followed by lateral movement to locate valuable customer databases or file servers. After exfiltration, the group provides a short negotiation window before publishing samples. Their leak site serves both as a shaming mechanism and a marketplace for other criminals to purchase or weaponize the stolen information.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, gaming handles, and real-world identity so you can see exactly what chains back to the ATG breach.
• Rotate any password you used at ATG anywhere else it is reused, then enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours instead of months.
• Cover the household with DoxxScan family protection that includes dependents and children’s gaming accounts which often chain to the same address or parent email.
• Let remediation specialists handle takedown requests for any exposed personal records while you focus on securing accounts and monitoring for suspicious activity.

The ATG breach is a reminder that even long-established gaming companies can become targets, and the data they hold travels farther and faster than most people expect. Taking concrete steps now limits how far criminals can extend the identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to gain visibility and control over what attackers already possess.