CHECKMARX Listed by lapsus$ Ransomware Group

On April 24, 2026, the ransomware group lapsus$ added cybersecurity firm Checkmarx to its leak site, claiming that it had exfiltrated internal files including source code, employee database records, API keys, and MongoDB and MySQL credentials.

Reported Details of the Incident

Public reporting indicates the data was taken during a ransomware attack on Checkmarx. The leak site lists the compromised material as internal documents rather than customer data, though the exact number of people affected remains unknown. Available reporting describes the exposed employee database as containing records that could include names, contact details, and other personally identifiable information.

The credentials for MongoDB and MySQL databases, along with API keys, represent a secondary risk because they could allow further access to systems that process or store personal data. No ransom demand deadline has been publicly confirmed in connection with this specific listing.

Why This Matters for You and Your Family

When a cybersecurity company is breached, the ripple effects reach ordinary people. Checkmarx provides application security testing tools used by thousands of organizations that hold your banking records, medical files, shopping history, and children’s school information. A leak of source code or credentials can accelerate attacks on those downstream systems.

Employee data exposure also means that anyone whose personal details were stored in Checkmarx’s internal systems now faces heightened risk of identity theft, phishing, and doxxing. If you or any member of your family has an account with a company that relies on Checkmarx services, this incident indirectly touches your household.

The Doxxing and Identity-Chain Risks

Credential leaks of this type rarely stop at one company. Once API keys or database logins appear on a ransomware site, they are quickly tested across other platforms. A single reused password or email address can link your professional life to personal accounts, gaming profiles, and family members’ online activity.

These connections form what security analysts call an identity chain. An attacker who obtains an employee email from the Checkmarx leak can use it to reset passwords elsewhere, harvest more credentials, and eventually publish personal addresses, phone numbers, or children’s usernames. Gaming accounts are especially vulnerable because they often share the same email addresses or passwords used for work or school services.

lapsus$ Track Record

Public reporting attributes the group’s emergence to 2022. Notable prior victims include NVIDIA, Samsung, Microsoft, and several large telecommunications providers. The group’s typical playbook involves gaining initial access through social engineering or stolen credentials, exfiltrating large volumes of data, and then publishing samples on leak sites to pressure victims into payment. In many cases lapsus$ has combined traditional ransomware tactics with direct doxxing of executives and employees.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what this claimed breach exposes about you and your family.
• Rotate any password you used at Checkmarx or any related service, replace it with a unique passphrase, and enable two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next time your information surfaces you learn within hours instead of months.
• Cover the household with DoxxScan family protection, which includes children’s gaming accounts that frequently chain back to the same emails and addresses used in corporate breaches like this one.
• Let remediation specialists handle takedown requests across data brokers and leak sites so you do not have to negotiate or chase attackers yourself.

The Checkmarx incident shows that even security companies can become gateways for identity theft that reaches your home. Taking concrete steps now limits how far attackers can travel along the chain of leaked credentials. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that explicitly protects children’s gaming accounts.