Summary
Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot, ransom noteRansomExx claims to have exfiltrated 215 MB from GoTip and published a single ZIP backup file named gotip_backup_20260313.zip. The leak page states the archive contains full database backups and provides the password Vm14a2QxVXlVbGhVYWxwU1lteEtUMVJXWkc5WFp3. Victim profile on the leak page identifies GoTip as a live-streaming tool based in Japan, and notes the leak post is published.
Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.
What was taken
GoTip - 1.13GB leaked. Gotip.jp is a Japanese live-streaming enhancement tool that connects digital tips (donations) to physical Bluetooth-enabled devices. It allows viewers to support creators by sending tips, which in turn trigger actions on devices owned by the creator, aimed at making live streams more interactive and engaging.
Ransom note
Published by the group on their leak site, reproduced verbatim.
We provide full database backups. However, the company shows little regard for its customers and is unconcerned about the safety of their personal data.
Also stated on the leak page
Fields this group publishes that do not map to a standard column. Labels are the site's own.
- The password for each archive is
- Vm14a2QxVXlVbGhVYWxwU1lteEtUMVJXWkc5WFp3
Leak-site images (1)
Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.