Ransomware victim disclosure
← All victimsIDERA
listed as Flash Charm INC (IDERA) · Claimed by coinbasecartel · listed 6 days ago
Status timeline
- Listed
May 15, 2026
Current state: Listed for ransom
At a glance
- Group
- coinbasecartel
- Status
- Listed for ransom
- Sector
- Technology
- Listed on leak site
- May 15, 2026
About the victim
AI dossier — public-source company profileIDERA is a software company known for developing database management, DevOps, and IT administration tools used by enterprises globally. The victim name 'Flash Charm INC' appears to be a legal or holding entity associated with IDERA. IDERA's products serve technology and infrastructure-heavy industries.
- Industry
- Enterprise Software & Database Tools
Attack summary
Severity: critical — The group claims exfiltration of highly sensitive operational technology (OT) data including DCS controller logic and shutdown sequences for energy infrastructure, combined with credential compromise at scale and claimed operational disruption (field workers locked out), representing a critical threat to critical infrastructure safety and operations.The group claims to have maintained persistent access to the victim's network for approximately three weeks, exfiltrating sensitive engineering data including Navisworks 3D models, P&ID diagrams, Honeywell DCS controller logic, and energy plant operational data; they also claim to have locked out field workers, suggesting operational disruption.
Data the group says was taken
AI dossier — extracted from the leak post- Navisworks 3D models
- P&ID diagrams
- Maintenance logic for energy plants
- Honeywell DCS controller logic
- Shutdown sequences and pressure point data
- Corporate VPN credentials
- Over 100 corporate identities
- Internal network protocols
The leak post
captured from the group's siteWe have changed our contact method. We now exclusively use qTox Messenger for all communications. SimpleX and Session have been discontinued. Our Tox ID: A7580331D4D16453CCE86D7ADFBCF0CEED0D0D1AEA8F4DBEEBCA9E3B46308F260DE9B41BD838 You may have noticed the sudden, heavy silence. The corporate VPNs are dead. We have been the silent architects of your network for the past three weeks. While your "elite" investigators from Mandiant sat in your logs, we sat directly beside them burning through over a hundred of your corporate identities like disposable tools. we have had your entire network and internal protocols. HOW LONG WILL YOU KEEP YOUR THOUSANDS OF FIELD WORKERS LOCKED OUT? We have successfully exfiltrated the most sensitive engineering data held by any firm in your sectors We hold the complete Navisworks 3D models, P&ID diagrams, and maintenance logic for your major energy plants. This includes the granular Honeywell DCS controller logic. We know the flow, the pressure points, and the shutdown sequences of your clients' billion-dollar assets. We have completed our audit. Now, the choice belongs to the APTIM Executive Leadership and your partners at Hunt LNG. Currently, your compa…
Sources
Source
Indexed 6 days agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
