Buffalo Neuroimaging Analysis Center Listed by coinbasecartel Ransomware Group

On March 30, 2026, the Buffalo Neuroimaging Analysis Center in Buffalo, New York, appeared on the leak site of the ransomware group known as coinbasecartel. The organization, which conducts MRI-based research for clinical trials on multiple sclerosis, Alzheimer’s, and Parkinson’s disease, is claimed to have had internal files exfiltrated during a ransomware attack. Public reporting indicates that the number of individuals whose personal information may have been exposed remains unknown.

What's Publicly Reported from Reporting

Available reporting describes the incident as a ransomware attack in which coinbasecartel gained access to the center’s systems and removed internal files. The group published details of the breach on its leak site, accessible via the onion address fjg4zi4opkxkvdz7mvwp7h6goe4tcby3hhkrz43pht4j3vakhy75znyd.onion/companies/bnac. No confirmed count of affected patients, research participants, or employees has been released. The data types involved are described only as internal files; specifics such as names, medical records, or contact details have not been publicly detailed by the victim or the attackers.

Why This Matters for You and Your Family

When a medical research organization suffers a breach, the information at risk often includes names, dates of birth, addresses, phone numbers, email addresses, and health details tied to clinical trials. If you or a family member has participated in a neurological study at the Buffalo Neuroimaging Analysis Center or received care connected to its research network, your data could now sit in an attacker’s archive. Medical research data is especially sensitive because it can reveal chronic conditions, genetic predispositions, or participation in drug trials—details that identity thieves, insurance companies, or harassers can exploit for years.

Even when victim counts are listed as unknown, families should assume their information is at risk until proven otherwise. A single exposed email or phone number is frequently the first link in a chain that leads to broader identity theft, financial fraud, or targeted scams.

The Doxxing and Identity-Chain Implications

Ransomware leaks rarely stop at one dataset. Attackers commonly cross-reference stolen information with other breaches to build detailed profiles. A username from an old gaming account, an email tied to a family member’s medical visit, and a phone number from a research consent form can quickly connect to your home address and children’s identities. This process, known as identity-chain mapping, turns isolated leaks into full doxxing packages that include social media handles, family relationships, and precise location data.

Credential leaks like this one cascade into account takeovers on gaming platforms, email services, and financial apps. Children’s gaming accounts are frequent targets because they often reuse passwords or recovery emails that appear in adult medical or research records. Once attackers control one account, they use it to reset others, escalating from data exposure to active harassment or extortion.

Coinbasecartel’s Publicly Known Track Record

Public reporting attributes coinbasecartel with emerging in late 2024 as a ransomware operation that combines data theft with extortion. The group is known for targeting healthcare, education, and research institutions. Notable prior victims have included smaller hospitals and specialized clinics, according to trackers monitoring ransomware leak sites. Their typical playbook begins with initial access through phishing or exploited remote desktop credentials, followed by exfiltration of internal files over several weeks. Once inside, they deploy ransomware to encrypt systems and then demand payment to prevent publication of the stolen data. If no payment is received, they publish samples or full datasets on their leak site, applying pressure through public embarrassment and the threat of further data sales.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what chains back to the Buffalo Neuroimaging Analysis Center breach.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours rather than months.
• Rotate any password you used at the Buffalo Neuroimaging Analysis Center or related research portals anywhere it has been reused, and switch to 2FA through an authenticator app instead of text messages.
• Cover the household with DoxxScan family coverage that extends protection to your children, including their gaming accounts that often chain back to the same family emails and addresses exposed in medical-research leaks.
• Let remediation specialists handle takedown requests across data brokers and leak sites so you do not have to negotiate directly with threat actors or spend weeks chasing down every copy of your information.

The speed with which ransomware groups publish stolen research and medical data shows that waiting for official notices is no longer enough. Taking concrete steps now limits how far this claimed breach can reach into your life and your family’s privacy. DoxxScan by GalaxyWarden delivers that protection through its continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.