alphv
Also known as: blackcatFirst seen September 9, 2021Active731 claimed victims
The claims below are reproduced as posted by alphv on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
The operators of the ALPHV/BlackCat ransomware began their activity in December 2021, making posts on Dark Web forums to promote their affiliate program, offering other actors the opportunity to engage in a 'new type of ransomware family' developed from scratch using the Rust programming language. Some clear evidence indicates that the actors behind this new ransomware are not new to cybercrime, and there were links to other affiliate programs such as DarkSide, BlackMatter, and REvil.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Duda Farm Fresh Foods A Duda & Sons , Inc Duda A Duda & Sons Duda Farm Fresh Foods Inc | July 14, 2022 | ransomware_live | — |
| dudacom | July 13, 2022 | ransomware_live | — |
| Hydraelectric | July 11, 2022 | ransomware_live | — |
| Bandai Namco | July 11, 2022 | ransomware_live | — |
| COUNT+CARE | ENTEGADE | July 10, 2022 | ransomware_live | — |
| Chen Moore and Associates | July 9, 2022 | ransomware_live | — |
| Podhurst Orseck | July 7, 2022 | ransomware_live | — |
| The Royal Commission for Riyadh City (RCRC) | July 7, 2022 | ransomware_live | — |
| Dusit D2 Kenz Hotel Dubai | July 6, 2022 | ransomware_live | — |
| adlerdisplaycom | Adler Display | July 1, 2022 | ransomware_live | — |
| HANSA KONTAKT | June 26, 2022 | ransomware_live | — |
| nutiscom | June 23, 2022 | ransomware_live | — |
| Matco Electric | June 18, 2022 | ransomware_live | — |
| Plainedge Public Schools | June 14, 2022 | ransomware_live | — |
| theallisoncom | June 14, 2022 | ransomware_live | — |
| The University of Pisa | June 11, 2022 | ransomware_live | — |
| vanderpol's | June 11, 2022 | ransomware_live | — |
| Purvis Industries | June 4, 2022 | ransomware_live | — |
| eivp-parisfr | June 2, 2022 | ransomware_live | — |
| Alexandria (LA) | June 2, 2022 | ransomware_live | — |
| CMC Electronics | May 31, 2022 | ransomware_live | — |
| AMS-Gruppe | May 31, 2022 | ransomware_live | — |
| Whitehall (OH) | May 30, 2022 | ransomware_live | — |
| M+A Partners | May 27, 2022 | ransomware_live | — |
| Klasner Solomon & Partners Chartered Professional Accountants | May 26, 2022 | ransomware_live | — |
| Carinthia, Austria | May 24, 2022 | ransomware_live | — |
| Imagen Television | May 24, 2022 | ransomware_live | — |
| GREEN MOUNTAIN ELECTRIC SUPPLY (gmescom) | May 24, 2022 | ransomware_live | — |
| Land Kärnten | May 23, 2022 | ransomware_live | — |
| SYSOL | May 22, 2022 | ransomware_live | — |
| Tecnopack | May 17, 2022 | ransomware_live | — |
| Boom Logistics (boomlogisticscomau) | May 17, 2022 | ransomware_live | — |
| YCUA | May 12, 2022 | ransomware_live | — |
| Campbell & Partners Consulting | May 10, 2022 | ransomware_live | — |
| The People's Federal Credit Union | tpfcucom | May 9, 2022 | ransomware_live | — |
| Horwitz Law, Horwitz & Associates | May 4, 2022 | ransomware_live | — |
| BRITISH LINK KUWAIT | May 3, 2022 | ransomware_live | — |
| Regina Public Schools | May 1, 2022 | ransomware_live | — |
| Innotec, Corp | April 29, 2022 | ransomware_live | — |
| Municipio de Quito | April 28, 2022 | ransomware_live | — |
| Phoenix/Packaging Inc | April 27, 2022 | ransomware_live | — |
| Davis Law Group, PC | April 27, 2022 | ransomware_live | — |
| j-w-andersoncom | April 26, 2022 | ransomware_live | — |
| FRISAcom | April 26, 2022 | ransomware_live | — |
| Richardson & Pullen, PC | April 26, 2022 | ransomware_live | — |
| Calvetti Ferguson | April 22, 2022 | ransomware_live | — |
| Alliant Physical Therapy DATA | April 21, 2022 | ransomware_live | — |
| DC ADVISORY | April 20, 2022 | ransomware_live | — |
| Trace Midstream | April 20, 2022 | ransomware_live | — |
| North View Escrow Corp | April 20, 2022 | ransomware_live | — |
| secovacom | Secova Inc | April 19, 2022 | ransomware_live | — |
| Monteleone & McCrory, LLP | April 15, 2022 | ransomware_live | — |
| eNoah it solutions | April 14, 2022 | ransomware_live | — |
| Barakat Travel and Private Jet was Hacked | April 10, 2022 | ransomware_live | — |
| wallyedgarcom | Wally Edgar Chevrolet | April 9, 2022 | ransomware_live | — |
| tgscomar | April 9, 2022 | ransomware_live | — |
| Florida International University (wwwfiuedu) | April 8, 2022 | ransomware_live | — |
| North Carolina A&T State University (wwwncatedu) | April 6, 2022 | ransomware_live | — |
| bet9jacom | goldbetit | April 6, 2022 | ransomware_live | — |
| Enoah Isolutions | April 5, 2022 | ransomware_live | — |
| wwwinnotecgroupcom | April 4, 2022 | ransomware_live | — |
| NECSUM TRISON | April 3, 2022 | ransomware_live | — |
| NECSUM | April 3, 2022 | ransomware_live | — |
| Favoris Holding AG (favoris-agch) | April 2, 2022 | ransomware_live | — |
| WKPZ Law | April 1, 2022 | ransomware_live | — |
| SSW Consulting | March 31, 2022 | ransomware_live | — |
| Dober | March 31, 2022 | ransomware_live | — |
| Rudsak Inc | rudsakcom | March 28, 2022 | ransomware_live | — |
| DC Solutions FR&Switzerland (dcsolutionch) | March 27, 2022 | ransomware_live | — |
| CASTGROUPCOMBR | March 27, 2022 | ransomware_live | — |
| VOYAGER DISTRIBUTING COMPANY PTY LTD | March 25, 2022 | ransomware_live | — |
| Relationships Australia | March 25, 2022 | ransomware_live | — |
| LW Group | March 23, 2022 | ransomware_live | — |
| inibsacom | inibsadentalcom | inibsanet 2TB FULL DATA | March 22, 2022 | ransomware_live | — |
| Maintainco Inc | maintaincocom | starliftcom | March 22, 2022 | ransomware_live | — |
| KELLY,REMMEL&ZIMMERMAN first part | March 22, 2022 | ransomware_live | — |
| Bradsby Group | bradsbygroupcom | March 21, 2022 | ransomware_live | — |
| unapeninternal | March 17, 2022 | ransomware_live | — |
| MTB | March 16, 2022 | ransomware_live | — |
| Bullfrog International | bullfrogspascom | March 15, 2022 | ransomware_live | — |
| Noble Oil | nobleoilcom | March 9, 2022 | ransomware_live | — |
| GEMS Education | gemseducationcom | February 25, 2022 | ransomware_live | — |
| JinkoSolarcom (NYSE: JKS) | February 20, 2022 | ransomware_live | — |
| Quantel Medical | quantel-medicalcom | February 18, 2022 | ransomware_live | — |
| IKPT | February 18, 2022 | ransomware_live | — |
| Phyllis Browning Company | phyllisbrowningcom | February 18, 2022 | ransomware_live | — |
| threesixtysourcingcom | February 17, 2022 | ransomware_live | — |
| Southwark Metal Manufacturing Co | southwarkmetalcom | February 16, 2022 | ransomware_live | — |
| HyLife | February 16, 2022 | ransomware_live | — |
| Swissport | February 15, 2022 | ransomware_live | — |
| ecostampa.it | February 14, 2022 | ransomware_live | — |
| Quantel Medical | February 13, 2022 | ransomware_live | — |
| NorthEast Coverages | February 13, 2022 | ransomware_live | — |
| Scherr Legate | February 13, 2022 | ransomware_live | — |
| Medical Staff | medicalstaff.com.au | February 13, 2022 | ransomware_live | — |
| NorthEast Coverages | northeastcoveragescom | February 9, 2022 | ransomware_live | — |
| chemtech.net | February 8, 2022 | ransomware_live | — |
| bishopeye.com | February 8, 2022 | ransomware_live | — |
| Scherr Legate | scherrlegatecom | February 8, 2022 | ransomware_live | — |
| maketherightcall.com hk-callcentre | February 6, 2022 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).