Peru LNG (Hunt LNG Operating Company) Listed by coinbasecartel Ransomware Group

On April 23, 2026, the ransomware group known as CoinbaseCartel added Peru LNG, operated by Hunt LNG Operating Company, to its leak site and claimed to have exfiltrated internal files from the Peruvian natural gas exporter.

What's Publicly Reported from Reporting

Public reporting indicates that Peru LNG runs the liquefied natural gas plant at Pampa Melchorita on the Peruvian coast and processes gas from the Camisea fields for export to international markets. The company has not yet issued a public statement confirming the breach. Available reporting describes the incident as a ransomware attack in which internal files were taken. The number of individuals whose personal information may be contained in those files remains unknown. No specific deadline for payment or further data publication has been publicly detailed on the leak site as of the latest available information.

Why This Matters for You and Your Family

When an energy company like Peru LNG suffers a breach, the stolen files can contain contracts, employee records, vendor details, or customer information that include names, addresses, phone numbers, and email accounts. Any of that data can be reused to target you or members of your household even if you have never directly done business with the company. Credential leaks from corporate environments frequently appear in later attacks on personal email, banking, and social media. For families this means one breach can quietly sit in criminal hands for months or years before it is used against you.

The Doxxing and Identity-Chain Implications

Ransomware operators rarely stop at the first set of files. Once internal documents are in circulation, threat actors map connections between corporate email addresses, personal accounts, and family details. A single exposed work phone number or spouse’s name can link to children’s gaming usernames, school records, or home addresses. These identity chains allow attackers to move from corporate extortion to personal doxxing, account takeovers, and harassment. Credential leaks like this one routinely cascade into gaming account compromises because the same passwords or recovery emails are often reused across work and home environments.

CoinbaseCartel’s Publicly Known Track Record

Public reporting attributes the group’s emergence to 2024. Notable prior victims have included cryptocurrency-related targets and mid-sized enterprises across several sectors. The group’s typical playbook begins with initial access through phishing or compromised credentials, followed by exfiltration of sensitive files and deployment of ransomware. They then list victims on a dark-web leak site and demand payment to prevent publication. Extortion style focuses on both financial ransom and the threat of gradual data dumps if demands are not met.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so hidden connections from breaches like Peru LNG cannot be exploited later.
• Rotate any password you used at Peru LNG or Hunt LNG Operating Company anywhere else it appears, then enable two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next time your information surfaces it is caught within hours instead of months.
• Cover the entire household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become the next link in doxxing chains after corporate leaks.
• Let remediation specialists handle takedown requests for any exposed personal records that appear on data broker sites or underground forums.

The incident shows that corporate ransomware attacks now reach ordinary families through everyday data trails. Acting quickly on the credentials and connections already exposed can limit the damage before the next stage of the attack begins. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.