A ransomware group claims it stole internal advertising, marketplace, and device activity data from Chartboost LLC, a mobile advertising technology company. Chartboost LLC has not confirmed this breach. The number of affected individuals is unknown. If you use related services, watch for official notifications and monitor your accounts for unusual activity.
| Company | Chartboost LLC |
|---|---|
| Industry | Other Commercial |
| Data Types Exposed | Publisher Account and Earnings Records, Advertiser and Publisher Performance Data, Marketplace Transaction Records, Advertising Identifiers and Device Details, Device Identity Mapping Records, Fraud Investigation Records |
| People Affected | Not Publicly Disclosed |
| Attack Method | Ransomware |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Chartboost LLC Data Breach?
A ransomware group has claimed responsibility for stealing internal business data from Chartboost LLC, a company involved in mobile advertising technology. According to the group’s own posting, the stolen material includes advertising performance records, marketplace transaction data, and device-level event logs. As of now, Chartboost LLC has not publicly confirmed this incident.
Because this claim comes from the attacker’s leak-site listing rather than a company statement, many details remain unverified. The listing describes a large volume of data, including records that reportedly span from January 2018 through September 2026. However, there is no independent confirmation yet of how the alleged intrusion occurred or when it actually began.
The posting also labels the data as “not paid,” suggesting the attacker is using public exposure as leverage after an alleged extortion attempt failed. This pattern is common in extortion-only incidents, where attackers skip file encryption and instead threaten to release stolen data unless paid. At this time, no forensic investigation findings have been made public, so the scope and validity of the claim cannot be independently verified.
Who was affected?
The claimed dataset reportedly touches several different groups connected to Chartboost LLC’s advertising network. This may include publisher companies, advertiser companies, and app users whose devices generated activity data. Because Chartboost LLC operates in mobile advertising, the alleged records could extend to a broad set of business partners rather than individual retail customers.
The number of affected individuals has not been publicly disclosed. The leak-site claim does reference large counts, such as hundreds of millions of identifier and activity rows, but these figures describe alleged file volumes rather than confirmed individual victims. As a result, the true number of people impacted, if any, remains unknown until the company responds or investigators verify the claim.
Given the nature of mobile advertising data, the scope could be geographically broad, potentially touching users across the United States and beyond. It is not yet clear whether minors could be among the device users represented in the alleged dataset. This uncertainty is another reason official confirmation from Chartboost LLC will be important.
What Information Was Potentially Exposed?
The ransomware group’s listing describes several categories of alleged stolen data tied to advertising operations. Because this is an unconfirmed claim, these categories should be treated as reported rather than verified. Based specifically on what the listing describes, the alleged exposure may include the following:
- Publisher account balance and earnings snapshots
- Advertiser and publisher performance reports, including impressions, clicks, installs, spend, and earnings
- Marketplace transaction records with auction and bid pricing
- App user device event data, including advertising identifiers, IP addresses, and device details
- Device identity mapping records and user app activity logs
- Fraud investigation records naming investigated publisher companies
If this claim is accurate, the risk would mostly affect businesses rather than individual consumers directly. For example, advertiser and publisher companies named in performance reports could face competitive harm if financial and operational data became public. In addition, exposed fraud investigation records could create reputational problems for companies named as having been investigated.
For individual device users, exposure of advertising identifiers paired with IP addresses and device details could still raise privacy concerns. This type of data does not typically include names or Social Security numbers. However, when combined with other information, it could potentially be used to profile a person’s app usage or location patterns over time.
What is the company doing?
Because this incident stems from an attacker’s claim rather than a company announcement, there is no publicly confirmed response from Chartboost LLC at this time. The company has not issued a statement confirming the breach, launching an investigation, or notifying affected parties, based on the information currently available.
Until Chartboost LLC speaks publicly, it is not possible to know what remediation steps, if any, are underway. Affected businesses and users should watch for official communication directly from the company. In the meantime, readers should treat the claim as unconfirmed while remaining cautious about related phishing attempts that often follow these leak-site postings.
What Should Affected Individuals Do?
Watch for Official Notifications
Anyone who works with or uses services connected to Chartboost LLC should watch for official communication. This includes emails, letters, or public notices confirming whether their data was part of any alleged incident. Because the claim is currently unverified, official word from the company will be the most reliable source of truth.
In the meantime, avoid clicking links in unsolicited messages claiming to be breach notifications. Scammers often use news of a reported breach to send fake alerts designed to steal login credentials. If you receive such a message, verify it directly through the company’s official website instead of clicking embedded links.
Monitor Accounts and Credit Reports
Even though this incident primarily involves business and device data, it is still wise to monitor your financial accounts. Regularly check bank and credit card statements for unfamiliar charges. This simple habit can help you catch fraud early, before it causes significant damage.
You can also request a free credit report from each of the three major credit bureaus once a year. Reviewing these reports allows you to spot unfamiliar accounts or inquiries. Doing this periodically is a good practice regardless of whether you were directly affected by this specific incident.
Be Alert for Phishing and Targeted Scams
Because advertising identifiers and device details may be involved in this claim, affected businesses and users should be alert to targeted phishing attempts. Attackers sometimes use stolen behavioral data to craft more convincing scam messages. As a result, it helps to be skeptical of unexpected emails referencing advertising accounts or app activity.
If you receive a suspicious message referencing an advertising platform or app account, do not provide personal information. Instead, contact the company through verified channels to confirm its authenticity. This extra step can prevent you from falling victim to a secondary scam built around this incident.
Consider Consulting a Data Breach Attorney
If it is later confirmed that your personal information was part of this incident, you may want to speak with a data breach attorney. An attorney can help you understand your legal options, including whether you qualify for compensation. Many offer free initial consultations, so there is little risk in asking questions early.
Because this situation is still developing, it is wise to keep records of any suspicious activity you notice. This includes unusual account access, unexpected emails, or signs of fraud. These details could become important if an official breach confirmation and legal claims process follow later.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.