alphv
Also known as: blackcatFirst seen September 9, 2021Active731 claimed victims
The claims below are reproduced as posted by alphv on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
The operators of the ALPHV/BlackCat ransomware began their activity in December 2021, making posts on Dark Web forums to promote their affiliate program, offering other actors the opportunity to engage in a 'new type of ransomware family' developed from scratch using the Rust programming language. Some clear evidence indicates that the actors behind this new ransomware are not new to cybercrime, and there were links to other affiliate programs such as DarkSide, BlackMatter, and REvil.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Ewig Usa | March 3, 2024 | ransomware_live | — |
| ipmaltamira | March 3, 2024 | ransomware_live | — |
| Kumagai Gumi Group | March 1, 2024 | ransomware_live | — |
| Petrus Resources Ltd | March 1, 2024 | ransomware_live | — |
| SBM & Co | March 1, 2024 | ransomware_live | — |
| Allan Berger & Associates | February 29, 2024 | ransomware_live | — |
| Change Healthcare - Optum - UnitedHealth | February 28, 2024 | ransomware_live | — |
| Electro Marteix | February 27, 2024 | ransomware_live | — |
| verbraucherzentrale hessen | February 27, 2024 | ransomware_live | — |
| S+C Partners | February 26, 2024 | ransomware_live | — |
| Angeles Medical Centers | February 26, 2024 | ransomware_live | — |
| Worthen Industries [FULL DATA] | February 24, 2024 | ransomware_live | — |
| ANDFLA SRL | February 23, 2024 | ransomware_live | — |
| Family Health center | February 23, 2024 | ransomware_live | — |
| Worthen Industries [We're giving you one last chance to save your business] | February 22, 2024 | ransomware_live | — |
| Hardeman County Community Health Center | February 22, 2024 | ransomware_live | — |
| Austen Consultants | February 21, 2024 | ransomware_live | — |
| KHSS (You have 3 days) | February 21, 2024 | ransomware_live | — |
| VSP Dental | February 18, 2024 | ransomware_live | — |
| LoanDepot | February 16, 2024 | ransomware_live | — |
| Prudential Financial | February 16, 2024 | ransomware_live | — |
| ASA Electronics [2.7 TB] | February 15, 2024 | ransomware_live | — |
| New Indy Containerboard | February 13, 2024 | ransomware_live | — |
| Procopio | February 13, 2024 | ransomware_live | — |
| Herrs | February 13, 2024 | ransomware_live | — |
| Trans-Northern Pipelines | February 13, 2024 | ransomware_live | — |
| ArcisGolf | February 13, 2024 | ransomware_live | — |
| The Source | February 13, 2024 | ransomware_live | — |
| Lower Valley Energy, Inc | February 12, 2024 | ransomware_live | — |
| SERCIDE | February 12, 2024 | ransomware_live | — |
| Rush Energy Services Inc [You have 48 hours] | February 12, 2024 | ransomware_live | — |
| Rush Energy Services Inc [Time's up] | February 12, 2024 | ransomware_live | — |
| maddockhenson | February 10, 2024 | ransomware_live | — |
| Grace Lutheran Foundation | February 9, 2024 | ransomware_live | — |
| Jewish Home Lifecare | February 8, 2024 | ransomware_live | — |
| Vail-Summit Orthopaedics & Neurosurgery (VSON) | February 5, 2024 | ransomware_live | — |
| Hydraflow | January 31, 2024 | ransomware_live | — |
| SportsMEDIA Technology | January 31, 2024 | ransomware_live | — |
| TECHNICA - HACKED AND MORE THEN 300 GB DATA LEAKED! | January 30, 2024 | ransomware_live | — |
| Dutton Brock | January 29, 2024 | ransomware_live | — |
| Draneas Huglin Dooley LLC | January 26, 2024 | ransomware_live | — |
| MBC Law Professional Corporation | January 24, 2024 | ransomware_live | — |
| Brightstar Care | January 24, 2024 | ransomware_live | — |
| Herrs (You have 72 hours) | January 23, 2024 | ransomware_live | — |
| Total Air Solutions | January 23, 2024 | ransomware_live | — |
| ANS COMPUTER [72hrs] | January 22, 2024 | ransomware_live | — |
| Worthen Industries [You have three days] | January 20, 2024 | ransomware_live | — |
| Busse & Busee, PC Attorneys at Law | January 19, 2024 | ransomware_live | — |
| FULL LEAK! Busse & Busee, PC Attorneys at Law | January 19, 2024 | ransomware_live | — |
| Builcore | January 12, 2024 | ransomware_live | — |
| R Robertson Insurance Brokers | January 11, 2024 | ransomware_live | — |
| automotionshade.com | January 11, 2024 | ransomware_live | — |
| SHIBLEY RIGHTON | January 11, 2024 | ransomware_live | — |
| Ursel Phillips Fellows Hopkinson | January 11, 2024 | ransomware_live | — |
| Triella | January 11, 2024 | ransomware_live | — |
| Group Bogart | January 10, 2024 | ransomware_live | — |
| Erbilbil Bilgisayar | January 8, 2024 | ransomware_live | — |
| SAED International | January 2, 2024 | ransomware_live | — |
| Clearwinds | December 30, 2023 | ransomware_live | — |
| Nej Inc was hacked | December 29, 2023 | ransomware_live | — |
| Erbilbil Bilgisayar (You have 72 hours) | December 29, 2023 | ransomware_live | — |
| Okada Manilla | December 29, 2023 | ransomware_live | — |
| Wesgar Inc | December 28, 2023 | ransomware_live | — |
| FIRST 5 Santa Clara County | December 27, 2023 | ransomware_live | — |
| Aura Engineering, LLC | December 27, 2023 | ransomware_live | — |
| Ultra Intelligence & Communications | December 27, 2023 | ransomware_live | — |
| Prefeitura Municipal de Itabira | December 24, 2023 | ransomware_live | — |
| PriceSmart (Update) | December 23, 2023 | ransomware_live | — |
| VF Corporation | December 22, 2023 | ransomware_live | — |
| Navigation Financial Group | December 20, 2023 | ransomware_live | — |
| Viking Therapeutics | December 19, 2023 | ransomware_live | — |
| Viking Therapeutics reported to the SEC following a breach | December 18, 2023 | ransomware_live | — |
| E & J Gallo Winery | December 16, 2023 | ransomware_live | — |
| Advantage Group International | December 13, 2023 | ransomware_live | — |
| LeClair Group | December 13, 2023 | ransomware_live | — |
| Deutsche Energie-Agentur | December 6, 2023 | ransomware_live | — |
| CLATSKANIEPUD | December 5, 2023 | ransomware_live | — |
| TraCS Florida FSU | December 5, 2023 | ransomware_live | — |
| Henry Schein Inc - Henry's " LOST SHINE " | December 5, 2023 | ransomware_live | — |
| Evnhcmc | December 4, 2023 | ransomware_live | — |
| Tipalti | December 4, 2023 | ransomware_live | — |
| Tipalti claimed as a victim - but we'll extort Roblox, one of their affected clients, indi | December 3, 2023 | ransomware_live | — |
| Tipalti claimed as a victim - but we'll extort Roblox and Twitch, two of their affected cl | December 3, 2023 | ransomware_live | — |
| royaleinternational.com | December 2, 2023 | ransomware_live | — |
| Lisa Mayer CA, Professional Corporation | December 2, 2023 | ransomware_live | — |
| IRC Engineering | December 1, 2023 | ransomware_live | — |
| Dörr Group | December 1, 2023 | ransomware_live | — |
| HTC Global Services | November 30, 2023 | ransomware_live | — |
| AQIPA | November 29, 2023 | ransomware_live | — |
| China Petrochemical Development | November 28, 2023 | ransomware_live | — |
| sillslegal | November 27, 2023 | ransomware_live | — |
| Fischione Instruments Inc | November 27, 2023 | ransomware_live | — |
| Vertex Resource Group | November 27, 2023 | ransomware_live | — |
| Spectrum Solutions LLC | November 24, 2023 | ransomware_live | — |
| TJM PRODUCTS PTY. LTD | November 24, 2023 | ransomware_live | — |
| LCA Consultores | November 24, 2023 | ransomware_live | — |
| Hampton Newport News CSB (Last chance) | November 24, 2023 | ransomware_live | — |
| Eckell Sparks Law Firm | November 23, 2023 | ransomware_live | — |
| NESPOLI GROUP | November 22, 2023 | ransomware_live | — |
| Fidelity National Financial | November 22, 2023 | ransomware_live | — |
Page 1 of 8Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).