Limocar by Transdev.ca Listed by Coinbase Cartel Ransomware Group

On October 26, 2025, Limocar, the intercity bus operator run by Transdev Canada, appeared on the leak site of the coinbasecartel ransomware group. The company, which provides transportation services linking Sherbrooke, Bromont and other communities in Quebec, is claimed to have had internal files exfiltrated during a ransomware attack. While the exact number of people affected remains unknown, anyone who has booked tickets, used their mobile app, or provided personal details for travel with Limocar could have information now in attackers’ hands.

What Public Reporting Shows

Public reporting indicates that Limocar by Transdev.ca was listed on the coinbasecartel leak site on October 26, 2025. The data consists of internal files exfiltrated after a ransomware intrusion. No precise victim count has been released, and the specific types of records exposed have not been detailed beyond the broad description of internal company documents. The listing appeared on an onion address hosted via ransomware.live, a common distribution point for such groups.

Why This Matters for You and Your Family

When a transportation company loses control of internal files, the information often includes names, addresses, phone numbers, email accounts, payment details, and travel histories. If you or your family have ever traveled with Limocar, booked tickets online, or stored a profile in their system, those records may now be available to criminals. Credential leaks like this one frequently cascade into account takeovers on other services where the same email and password are reused. Children’s accounts tied to family email addresses are especially vulnerable because gaming platforms and school-related logins often share the same credentials.

The Doxxing and Identity-Chain Implications

Once internal files leave a company’s control, attackers and downstream data brokers can link your travel patterns to home addresses, phone numbers, and family relationships. This creates an identity chain: an email from a booking can be matched to a gaming username, a child’s Roblox or Fortnite account, or a parent’s social-media handle. The result is doxxing that goes far beyond one bus ticket. Public reporting shows these chains accelerate when ransomware groups publish raw files rather than simply demanding ransom. Your family’s everyday activities, from school commutes to weekend trips, can become permanent public records if the exposed data is indexed or sold.