CoinbaseCartel hacker claims American audio behemoth Dolby
The company’s name was recently uploaded by cybercriminals who claim responsibility for a data breach. The alleged attackers are known for breaching SK Telecom, South Korea’s largest mobile carrier, last year.
Image by Cybernews.
The company’s name was recently uploaded by cybercriminals who claim responsibility for a data breach. The alleged attackers are known for breaching SK Telecom, South Korea’s largest mobile carrier, last year.
- CoinbaseCartel posted Dolby Laboratories on its dark web leak site during Super Bowl weekend claiming a data breach.
- The hacker group password-protects stolen data to show it only to potential buyers rather than the public.
- CoinbaseCartel previously breached SK Telecom and threatened to leak source code after the company refused to negotiate.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Dolby Laboratories' name appeared on CoinbaseCartel’s dark web blog the gang uses to showcase its latest victims. It appears the American company was posted over the Super Bowl weekend.
Dolby is a major US tech corporation, focusing on audio products and consumer electronics. The company’s reported revenue exceeded $1.3 billion in 2025, with over 2,000 staff across numerous locations.
We have reached out to the company for comment and will update the article once we receive a reply.
So far, the attackers have not provided any data samples or other information that would help to evaluate the severity of the alleged data breach. Unlike other ransomware outfits, CoinbaseCartel keeps the data “password protected.”
According to the Cybernews research team, the password disclaimer is not a goodwill gesture from the attackers. More likely, cybercrooks adhere to a recent trend in the cybercriminal business, only showing data to potential buyers, be it the victim company or other cybercrooks.
Interestingly, CoinbaseCartel denies it’s a ransomware cartel and claims to be dealing only in data acquisition. However, the dark web leak site and extortion aspect of the operation make it difficult to view the organization as anything but a ransomware cartel.
The gang is among the freshest outfits, having been first observed in September 2025. CoinbaseCartel started with a well-publicized attack on SK Telecom. After the South Korean company refused to start negotiations, the gang threatened to leak its source code.
Several other larger corporations are posted alongside SK Telecom, including Desjardins Group, a Canadian financial services coop, and North America’s largest federation of credit unions.
The Cybernews researchers have earlier noted that at least some of the gang's victims have been claimed by other ransomware cartels in the past, which could point to attackers recycling old data.
Cybercrooks often recycle stolen details to get the most out of victim organizations. One of the reasons law enforcement authorities advise against meeting criminals’ demands is that attackers tend to repeatedly target organizations that pay.
Unlock more exclusive Cybernews content on YouTube.