On 1 August 2026, the data-extortion group CoinbaseCartel added MIM Fertility to its dark web leak site, with downstream reporting claiming the attack disrupted IVF treatment, egg freezing and genetic testing services. Every element of that claim traces back to the threat actor's own leak-site post. As of publication there is no victim statement, no regulator filing and no CERT or vendor advisory confirming the incident. Worse, the sources do not agree on who MIM Fertility actually is: leak-site-derived copy describes a US clinic network, aggregators tag the listing GB, and MIM Fertility's own public material describes a Poland-headquartered AI software vendor that sells embryo-evaluation tools to IVF clinics rather than treating patients. Readers should treat this as an unverified extortion listing with a contested victim profile, not a confirmed patient-data breach.
What Happened
HackerFeeds (S2) records the mechanics of the listing cleanly: target MIM Fertility, threat group coinbasecartel, region GB, sector healthcare, target domain mimfertility.ai, breach and discovery date both logged as 2026-08-01, severity rated MEDIUM. The listing points to a .onion address on CoinbaseCartel's leak portal. HackerFeeds explicitly flags that the entry reflects what the threat actor publicly claimed and that it has not been independently verified.
UNDERCODE NEWS published two pieces the same day. The first (S3), sourced to ThreatMon's monitoring, frames MIM Fertility as one of two new additions to the leak portal alongside Xs Cad, and cautions that ransomware groups frequently publish victim names before negotiations conclude, so listings are indicators requiring verification rather than proof of successful compromise. The second UNDERCODE piece (S1), sourced to a post by "Cybersecurity News Everyday," is where the operational-disruption angle originates: it reports that the incident allegedly disrupted IVF treatment, egg-freezing services and genetic testing. That same article states plainly that no independently verified evidence was presented showing which systems were compromised, how many patients were affected, or whether patient data was actually stolen. HackerFeeds' summary of the CoinbaseCartel listing (S2) contains no disruption claim at all; it is a boilerplate company description, marked AI-generated, listing IVF, egg freezing, preimplantation genetic testing and fertility preservation as services the organisation offers. That reads far more like a service catalogue lifted from a company profile than a statement of what the attack broke.
Accounts also differ materially on geography and business model. S1 and S2 place the victim in the UK or GB. The AI-generated leak-site summary in S2 simultaneously calls MIM Fertility "a US-based fertility clinic network." MIM Fertility's own LinkedIn presence (S4, S5) describes a company founded in 2021, headquartered in Ochota, Mazowieckie, Poland, with an office in Warszawa and staff distributed across Poland and Mexico, 20 to 30 employees, roughly $2M in total funding, selling AI products branded EMBRYOAID and FOLLISCAN to fertility specialists. Its recent public activity is conference marketing around ESHRE 2026 in London, 5 to 8 July, Booth C27. Under the sourcing hierarchy, the company's own material is the strongest evidence available here, and it does not support "UK fertility provider" or "US clinic network." The most defensible reading is that CoinbaseCartel or its summarisation tooling mislabelled a Poland-based IVF software vendor as a clinic, and that the ESHRE London footprint may explain the GB tag.
One further caution: a "Notice of Data Security Event" (S6) circulating in the same source set concerns Women's Wellness of Southern Delaware, dated 26 June 2026, and is unrelated to MIM Fertility. It should not be read as a breach notification for this incident.
What Was Taken
Nothing has been confirmed as stolen. No source in this set publishes a record count, a data sample, a file listing, a ransom demand or an exfiltration volume. There is no range of figures to report because no figure has been reported by anyone.
What is at stake is worth stating precisely, because the answer depends on which version of MIM Fertility is correct. If the victim is a clinic, as the leak-site copy asserts, the exposed categories would include reproductive medical histories, genetic and preimplantation test results, treatment records, identification documents and financial data, plus records tied to stored biological material. If the victim is the AI vendor its own public material describes, the more likely holdings are clinical imagery and model training data (embryo time-lapse and follicle scan datasets), integration credentials into partner IVF clinics, and commercial agreements with the named institutions in its ESHRE speaker roster. That second scenario is a supply-chain exposure rather than a direct patient breach, and it carries different notification obligations and a different blast radius.
Both readings involve special-category health data under UK GDPR and the EU GDPR. Neither is confirmed.
Why It Matters
CoinbaseCartel is not a conventional encrypting ransomware operation, and framing this as "ransomware disrupting IVF" is probably wrong on the mechanics. Halcyon (S7) categorises the group as "Data Extortion Only," active since September 2025, with a threat level of 6.5 and over 100 claimed targets across healthcare, technology, transportation, manufacturing and business services. The group draws from the ShinyHunters, Scattered Spider and Lapsus$ ecosystem collectively tracked as Scattered Lapsus$ Hunters, and functions as a splinter focused on data-theft-led extortion. A tracker lists shinysp1d3r as an alias, but Halcyon notes that name refers to an in-development VMware ESXi encryptor that has not been observed in attacks. Halcyon also states clearly that the operation has no connection to the legitimate cryptocurrency company Coinbase. UNDERCODE (S3) describes the group as employing double extortion including encryption, which conflicts with Halcyon's assessment; the vendor threat-actor profile is the stronger source and should be weighted accordingly.
If the group does not deploy encryptors, then a service outage at an IVF provider is not the expected outcome of a CoinbaseCartel intrusion, and the disruption claim in S1 becomes the weakest link in the chain rather than the headline. That distinction matters for defenders: the countermeasure for data-theft extortion is identity hardening and egress control, not backup restoration speed.
Halcyon adds two calibration points defenders should internalise. At least two CoinbaseCartel claims have been pulled from tracker databases after the listed organisations denied any breach, so a percentage of this group's listings are inflated or wrong. At the same time, independent analysis confirms many of its breaches are genuine, with stolen logins traced back to infostealer infections predating the attacks by months or years. Skepticism about any single listing is warranted; complacency about the group is not.
The sectoral signal is the real story. A 20-to-30-person AI vendor sitting between multiple international IVF clinics is a high-leverage target precisely because it is small, well funded enough to pay, and connected to institutions far larger than itself. MIM Fertility's own ESHRE announcement (S4) names partners including Imperial College Healthcare NHS Trust, IVI RMA Global, Reprotec Fertility Center, Invimed, Adora Fertility, Madina Women's Hospital and Rainbow IVF Center. Compromise of a vendor with that reach is a concern for every one of those organisations regardless of how this particular claim resolves.
The Attack Technique
No initial access vector has been established for this incident. S1 states outright that the available information does not establish how the alleged intrusion occurred, and no other source offers one.
The group's known pattern is the best available proxy. Halcyon (S7) attributes many confirmed CoinbaseCartel breaches to stolen credentials sourced from infostealer infections that predate the intrusion by months or years, consistent with the wider Scattered Lapsus$ Hunters tradecraft of identity-centric attacks: credential replay, social engineering of help desks, MFA fatigue and SaaS tenant access rather than perimeter exploitation. DeXpose (S8), covering the group's 20 July 2026 listing of Colliers Real Estate in Canada, records the standard playbook: access sensitive data, threaten a full leak unless the victim opens negotiations, and pressure through public listing. The threat actor statement quoted there, "We have accessed Colliers' sensitive data. Full leak will be released unless contacted," is representative of how these listings are worded and how little technical detail they contain.
The MIM Fertility listing appeared the same day as CoinbaseCartel entries for CEN and CENELEC (Belgium), M. B. Kahn Construction Co. (US, manufacturing), and Xs Cad (technology), per S2. A four-victim batch drop in one day is consistent with a group publishing accumulated claims on a schedule rather than executing four simultaneous intrusions.
What Organizations Should Do
- Treat this listing as unverified and press MIM Fertility directly. Any clinic using EMBRYOAID or FOLLISCAN should request a written statement on whether an intrusion occurred, what data was held, and whether integration credentials or API tokens need rotation. Do not wait for a public notification that may never come.
- Rotate and re-scope third-party integration credentials now. Where an IVF platform holds a service account, API key or federated identity into your imaging systems or EMR, rotate it, cut its permissions to the minimum, and confirm it cannot be used from unexpected geographies.
- Hunt for infostealer-derived credentials against your own tenants. Given Halcyon's finding that CoinbaseCartel access frequently originates from stealer logs aged months or years, query dark web and stealer-log monitoring for your domains and force resets on any hit, including dormant and contractor accounts.
- Harden identity against the SLSH playbook specifically. Enforce phishing-resistant MFA (FIDO2 or passkeys) rather than push or SMS, add out-of-band verification for help desk password and MFA resets, and alert on impossible-travel and new-device enrolment.
- Instrument egress, not just endpoints. A data-theft-only group leaves no encryption event to trip on. Baseline normal outbound volume from data stores and imaging repositories, and alert on bulk reads, unusual archive creation and transfers to cloud storage or file-sharing services.
- Plan for the special-category data scenario in advance. For reproductive and genetic health data, map your UK GDPR and GDPR notification clocks, ICO reporting path, and patient communications before an incident, and rehearse the decision on clinical continuity if a scheduling or imaging dependency goes offline mid-cycle.
- Engage response and legal counsel before any contact with the actor, and preserve forensic evidence first. DeXpose (S8) makes the same point in its recommended actions, and it holds regardless of whether the claim proves genuine.
Sources: UK Fertility Provider MIM Fertility Reportedly Hit by CoinbaseCarte... | Ransomware group coinbasecartel hits MIM Fertility HackerFeeds | CoinbaseCartel Expands Its Ransomware Campaign, MIM Fertility and X... | ESHRE 2026. The names are out. And this is big. 🔥 MIM Fertility | A patient once compared her embryo’s grade to her friend’s and assu... | Notice of Data Security Event | CoinbaseCartel | Coinbasecartel Strikes Colliers Real Estate in Canada - DeXpose