alphalocker
First seen January 24, 2024Active31 claimed victims
The claims below are reproduced as posted by alphalocker on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
AlphaLocker is a low-cost ransomware operation built on the EDA2 open-source project that sells affiliates an admin panel, ransomware executable, and decryption key generator, lowering the barrier for entry-level cybercriminals using double-extortion tactics.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| www.pyramisgroup.com | February 28, 2026 | ransomware_live | — |
| www.bew.co.th | November 16, 2025 | ransomware_live | — |
| www.automotiveml.com | November 3, 2025 | ransomware_live | — |
| www.unterkofler.info | November 3, 2025 | ransomware_live | — |
| www.myriversidedentaloffice.com | November 3, 2025 | ransomware_live | — |
| www.verdugohillsdental.com | October 31, 2025 | ransomware_live | — |
| www.mercantetubos.com.br | October 13, 2025 | ransomware_live | — |
| www.libertydentaltown.com | October 5, 2025 | ransomware_live | — |
| www.adhunikpower.com | October 1, 2025 | ransomware_live | — |
| www.sonoshowmoveis.com.br | September 29, 2025 | ransomware_live | — |
| grupozeta.com & www.grupozetajalisco.com | September 16, 2025 | ransomware_live | — |
| gazomet.pl & cgas.pl | September 8, 2025 | ransomware_live | — |
| ipathpr.com | September 8, 2025 | ransomware_live | — |
| nubox.com & sumasaas.com | September 8, 2025 | ransomware_live | — |
| www.arkworkplacerisk.co.uk | August 9, 2024 | ransomware_live | — |
| goftac.com/ firsttx.com First Texas Alliance Corp (FTAC) | August 8, 2024 | ransomware_live | — |
| biw-burger.de | August 6, 2024 | ransomware_live | — |
| goftac.com/ firsttx.com First Texas Alliance Corp (FTAC) | August 6, 2024 | ransomware_live | — |
| www.consorzioinnova.it | August 6, 2024 | ransomware_live | — |
| www.carri.com | August 6, 2024 | ransomware_live | — |
| https://goftac.com/ firsttx.com First Texas Alliance Corp (FTAC) | April 24, 2024 | ransomware_live | — |
| https://geodis.com | April 18, 2024 | ransomware_live | — |
| https://www.consorzioinnova.it | March 9, 2024 | ransomware_live | — |
| BM Catalysts bmcatalysts.co.uk | February 14, 2024 | ransomware_live | — |
| elandenergy.com Eland Energy | January 26, 2024 | ransomware_live | — |
| https://www.mikeferry.com | January 24, 2024 | ransomware_live | — |
| a24group.com ambition24hours.co.za | January 24, 2024 | ransomware_live | — |
| accolade-group.com + levelwear.com +Taiwan microelectronics(CRM). | January 24, 2024 | ransomware_live | — |
| https://www.gadotbio.com/ Gadot Biochemical Industries Ltd | January 24, 2024 | ransomware_live | — |
| https://www.carri.com | January 24, 2024 | ransomware_live | — |
| IntegrityInc.org Integrity Inc | January 24, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).