Skip to content

Search Ransomware Intelligence

Jump to a group, country, industry or search victims.

Listed on a ransomware leak site

Northcroft

northcroft.com

Northcroft was listed on the Coinbase Cartel leak site on Mar 30, 2026. Information as of Oct 19, 2026.

Country: United KingdomIndustry: Unknown
Updated continuously · figures as of Oct 19, 2026
Claimed by
Coinbase Cartel
First listed
Mar 30, 2026
Claims recorded
1

Leak-Site Claim.

Coinbase CartelConfirmed claim
Posted on the leak site
Mar 30, 2026
Collected by Brandefense
Mar 30, 2026
Data claimed
Not stated
Leak-site post text, written by the group
Northcroft is a global construction consultancy firm that delivers project management and cost management services for buildings, infrastructure, and the environment. Founded in 1840, the company is headquartered in London, UK. It serves clients in a variety of sectors, including healthcare, transportation, education, commercial, and leisure. Its services include cost consulting, project management, and business consulting.

Get alerted the moment your company or a supplier is posted on a leak site.

Alert me
Other confirmed victims claimed by the same group
VictimClaimed byCountryIndustryData claimedPosted
Westwing Group SE
westwing.com
Coinbase CartelDEGermanyRetailNot stated
Integrated Health Systems
integratedhealthstack.com
Coinbase CartelUSUnited StatesTechnologyNot stated
RXPE Group
rxpe.com
Coinbase CartelCNChinaEnergy and UtilitiesNot stated
Tower Insurance
tower.co.nz
Coinbase CartelNZNew ZealandInsuranceNot stated
Flecha Bus
flechabus.com.ar
Coinbase CartelARArgentinaTransportation and LogisticsNot stated
OTEIS Conseil & Ingénierie
oteis.fr
Coinbase CartelFRFranceConsultingNot stated

Get Real-Time Alerts, IOC Feeds And Takedowns.

The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.

Figures as of Oct 19, 2026. Confirmed leak-site claims collected by Brandefense technologies and validated by Brandefense analysts.

Listed on a leak site means a ransomware group has claimed the company; it is not a confirmed breach. To request a correction or removal, contact Brandefense.