Ira & Larry Goldberg Coins & Collectibles Listed by cmdorganization Ransomware Group

On May 14, 2026, cmdorganization added Ira & Larry Goldberg Coins & Collectibles to its leak site, claiming that internal files had been exfiltrated from the family-owned numismatic auction house during a ransomware attack.

What's Publicly Reported from Reporting

Public reporting indicates the attackers gained access to the company’s systems, copied internal documents, and later published proof of the breach on their dedicated leak page. The exact number of records exposed remains unknown, and the specific contents of the stolen files have not been independently verified by third parties. Goldberg Coins & Collectibles, established in 1930, specializes in rare coins, collectibles auctions, and personalized consultations for collectors and investors. The company has not yet issued a public statement detailing the timeline of the intrusion or the steps taken to contain it.

Why This Matters for You and Your Family

When a business that handles personal information suffers a breach, your data can be exposed even if you are not the primary target. Clients who have consigned coins, provided identification for transactions, or shared contact and payment details with the auction house may now find that information circulating among criminals. Internal files often contain names, addresses, phone numbers, email accounts, and sometimes financial or identity documents. Once that material leaves the company’s control, it can be sold, traded, or used to launch further attacks against you and your family.

The Doxxing and Identity-Chain Implications

Stolen internal files rarely stay isolated. Criminals combine newly leaked data with information already circulating from earlier breaches, creating detailed profiles that link your email addresses, phone numbers, usernames, and real-world identity. These chains allow attackers to reset passwords on personal accounts, impersonate family members, or publish private details online. Credential leaks of this nature frequently cascade into gaming account takeovers, especially for children who reuse usernames or email addresses across platforms. A single auction-house breach can therefore become the missing link that exposes an entire household’s digital footprint.

cmdorganization’s Publicly Known Track Record

Public reporting attributes the group’s emergence to late 2024. It has since listed dozens of organizations, focusing primarily on small and mid-sized businesses. Notable prior victims include other family-run operations and service providers whose internal documents were published after ransom demands went unmet. The group’s typical playbook involves initial access through phishing or exploited remote desktop credentials, followed by exfiltration of sensitive files and deployment of ransomware. If payment is not received, the attackers publish samples on their leak site and threaten full data release, using the public exposure as leverage.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity so you can see exactly what this claimed breach connects to.
• Rotate any password you have used with Goldberg Coins & Collectibles and enable 2FA through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught and addressed in hours rather than months.
• Cover the household with DoxxScan family coverage that includes dependents and children’s gaming accounts, which often chain back to the same addresses and identities used in adult transactions.
• Let remediation specialists handle takedown requests across data brokers and leak sites so you do not have to negotiate directly with threat actors or spend weeks chasing removal notices.

The breach of Ira & Larry Goldberg Coins & Collectibles shows how quickly personal information held by specialized businesses can reach criminals who specialize in chaining it to other data sources. Taking concrete steps now limits the damage and reduces the chance that this incident becomes the starting point for identity theft or doxxing aimed at you or your children. DoxxScan by GalaxyWarden delivers continuous monitoring across more than 13.1 billion+ breach records and over 100 platforms, AI-powered identity-chain mapping that connects scattered handles to real identities, and hands-on remediation by specialists who manage takedowns for the entire household, including children’s gaming accounts that frequently become targets once credential leaks occur.