The CoinbaseCartel Data Theft at Cognizant: Catching the Slow Drift Before the Data Leaves

In April 2026 the data-extortion group CoinbaseCartel listed the IT services company Cognizant on its leak site. Such a group does not lock the files. It steals a copy of the data and threatens to publish it, so backups do not remove the threat. The only time the theft can be stopped is while the data is still inside the organisation. This concept note describes a run-time method for that moment. For every account, service and AI agent, a list states what it is meant to do, and anything outside the list is refused and counted. A running warning number is worked out from its activity, counted in small groups. When the number says an account is drifting, a computer decides at once, without waiting for a person, to move that one account to a safer level and to slow what it carries out. This is the shunting action. It moves the load aside instead of stopping the work, so the rest of the organisation carries on. A second part reads the verdict of a security detector at several of its own settings, so a firm alert can be told from a shaky one. The note follows the four stages of such an attack in simple words, explains how the method differs from Bayesian networks, Monte Carlo dropout and today's log-based systems, and cites the related papers. It uses only publicly reported facts about the incident and applies to every organisation that holds data. Keywords data theft, extortion, early warning, shunting action, run-time security, AI agents, intrusion detection, Cognizant, CoinbaseCartel