Novogene Listed by coinbasecartel Ransomware Group

On March 15, 2026, genomics company Novogene appeared on the leak site of the ransomware group known as coinbasecartel. Internal files were allegedly exfiltrated during a ransomware attack, and the company’s customer, partner, and operational data are now at risk of public release.

What's Publicly Reported from Reporting

Public reporting indicates that coinbasecartel added Novogene to its data-leak portal on that date. The posting states that internal files were taken during a ransomware incident, although the exact volume of data and the number of people affected remain undisclosed. Novogene, founded in 2011, operates laboratories and offices in China, the United States, the United Kingdom, and Singapore. The company provides next-generation sequencing and bioinformatics services used by researchers, universities, pharmaceutical firms, and healthcare organizations worldwide.

Available reporting describes the exposed material as internal files rather than a narrowly defined set of customer records. No sample data has been published so far, and the group has not yet set a public deadline for ransom payment or further leaks. Industry trackers continue to monitor the leak site for updates.

Why This Matters for You and Your Family

If you or anyone in your household has ever used a genetic testing service, participated in a research study, or received medical care that involved DNA sequencing, your information could be among the records at risk. Genomic data is permanent and uniquely identifying. Unlike a credit card number, it cannot be changed. A leak today can create lifelong privacy and security consequences for you and your children.

Even if you have never directly done business with Novogene, the company works with many partner organizations. Data shared with hospitals, universities, or direct-to-consumer testing kits can travel through supply chains that ultimately touch Novogene’s systems. When one link in that chain is breached, the exposure can reach people who never knew their samples were processed there.

The Doxxing and Identity-Chain Implications

Genomic information is especially dangerous when combined with other personal details. Names, email addresses, phone numbers, and family relationships that appear in the same internal files can be used to build detailed profiles. Attackers routinely link these records across multiple breaches to create “identity chains” that reveal where you live, where your children go to school, and which online accounts belong to which family member.

Credential leaks from one service often cascade into gaming accounts, social media, and email. Children’s gaming profiles are frequent targets because they frequently reuse passwords or email addresses tied to family data. Once an attacker controls a child’s account, they can harvest additional personal details and use them to pressure the rest of the household. This is why services that map these connections matter.

Coinbasecartel’s Publicly Known Track Record

Public reporting attributes the coinbasecartel ransomware group with operations that emerged in recent years. The group is known for targeting organizations across technology, healthcare, and research sectors. Notable prior victims have included companies whose internal documents were later posted on dark-web leak sites when ransom demands went unmet.

The group’s typical playbook involves gaining initial access, exfiltrating sensitive files before encryption, and then pressuring victims through public exposure rather than solely through encryption alone. They list companies on their leak portal with countdown timers, releasing samples or full datasets if payment is not received. Exact tactics vary by victim, but the pattern of double extortion—ransomware plus data theft—remains consistent according to available reporting.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what chains exist before attackers exploit them.
• Rotate any password you used with genetic testing services, research portals, or healthcare providers that may have routed samples to Novogene, and enable two-factor authentication with an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught and addressed in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become entry points when credential leaks cascade into doxxing chains.
• Let remediation specialists handle the time-consuming work of sending takedown requests to data brokers and monitoring for reappearance of your information.

The incident shows that even organizations handling the most sensitive biological data remain targets. Taking concrete steps now can limit how much of your family’s information becomes usable by criminals later. Start your DoxxScan trial and let its continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage—including children’s gaming accounts—work on your behalf.