Northcroft
bd_87bc2fa973aa8cd3 · schema v1 · pii pii-v1
Full breach record for Northcroft →Threat-actor claim — not a regulatory filing
This row is a claim by the ransomware group Coinbasecartel on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
Source: Ransomware.live
Post text · scraped from the leak site
Northcroft is a global construction consultancy firm that delivers project management and cost management services for buildings, infrastructure, and the environment. Founded in 1840, the company is headquartered in London, UK. It serves clients in a variety of sectors, including healthcare, transportation, education, commercial, and leisure. Its services include cost consulting, project management, and business consulting.
Source provenance
- Source URL
- https://www.ransomware.live/
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 30, 2026
- Raw hash
- c8adb3d733111751b8b23b8cb481118ef61bac756c9797a53385b5a8a9e75e6b
Reporting entity
- Name
- coinbasecartel
Victim entity
- Name
- Northcroftnorm: northcroft
- Domain
- northcroft.com
- Industry
- Construction
What this source establishes
- Source ceiling
- A leak-site claim can't tell us: discovery date · materiality · notification · affected count · confirmed data types · compliance clock. These stay blank until a regulatory filing or victim disclosure lands.
- Attack vector
- Ransomware· coinbasecartel
- Threat actor
- CoinbasecartelExternalFinancial
Compliance
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.