Ransomware victim disclosure
← All victimsCoCo Yachts
Claimed by cephalus · listed 9 months ago
Status timeline
- Listed
Aug 28, 2025
- Data leaked
At a glance
- Group
- cephalus
- Status
- Data leaked
- Country
- Netherlands
- Sector
- Manufacturing
- Listed on leak site
- Aug 28, 2025
- Data size
- 1.8 TB
About the victim
AI dossier — public-source company profileCoCo Yachts B.V. is a Dutch maritime design company headquartered in Gorinchem, Netherlands, founded in November 2011. The company specialises in the design of innovative aluminium vessels including high-speed passenger ferries, patrol boats, hybrid survey vessels, and yachts. It operates internationally, with construction partners in India, China, and elsewhere, and has received recognition such as Ship of the Year 2024 for its fully electric ferry designs.
- Industry
- Naval & Maritime Vessel Design
- Address
- Edisonweg 21e, 4207 HE Gorinchem, Netherlands
- Employees
- 11-50
- Founded
- 2011
Attack summary
Severity: critical — The exfiltration of 1.8 TB includes claimed naval/military ship design data (a country's naval vessel designs), which constitutes sensitive defence-related intellectual property, alongside PII (employee and client data). The combination of potential national-security-relevant design data and large-scale personal/business data warrants a critical classification.The group 'cephalus' claims to have exfiltrated 1.8 TB of data from CoCo Yachts, including project files, client information, employee records, and purportedly naval ship design data attributed to an unspecified country. The group states a data download link is forthcoming.
Data the group says was taken
AI dossier — extracted from the leak post- Project files
- Client information
- Employee information
- Naval ship design data
What the group claims
We got a total of 1.8TB+ of data,including project,clients,employee information,and a certain country's naval ship design..... The data link will coming soon
Sources
- Victim sitewww.cocoyachts.com
Source
Indexed 9 months agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
