THREAT ACTOR
ALPHV_
DormantALPHV, also known as BlackCat, was a Rust-based ransomware-as-a-service operation that emerged in late 2021 and quickly established itself as one of the most technically sophisticated families on the scene. Its affiliates targeted MGM Resorts, Caesars, and Change Healthcare. The group “exit-scammed” in early 2024 after seizing the ransom paid by Change Healthcare.
For Ransomnews editorial coverage of ALPHV, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
773
Victims tracked
0 / 275
Active mirrors
2021-12-18
First listing
2024-03-03
Most recent
Victims by year
- 2024 60
- 2023 454
- 2022 244
- 2021 15
Leak site mirrors
275 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onionTHIS WEBSITE HAS BEEN SEIZED snapshot · 2024-06-25 20:07 -
2cuqgeerjdba2rhdiviezodpu3lc4qz2sjf4qin6f7std2evleqlzjid.onionStart-maximized.com snapshot · 2022-04-09 21:12 -
alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion404 Not Found snapshot · 2024-06-25 20:07 -
vqifktlreqpudvulhbzmc5gocbeawl67uvs2pttswemdorbnhaddohyd.onionTHIS WEBSITE HAS BEEN SEIZED snapshot · 2024-06-25 20:02 -
alphvuzxyxv6ylumd2ngp46xzq3pw6zflomrghvxeuks6kklberrbmyd.onionTHIS WEBSITE HAS BEEN SEIZED snapshot · 2024-03-09 16:04 -
d75itpgjjfe2ys2qivqplbvmw3yyx7o5e4ppt2esit2lluhngulz4hqd.onionsnapshot · 2024-12-09 17:35 -
sty5r4hhb5oihbq2mwevrofdiqbgesi66rvxr5sr573xgvtuvr4cs5yd.onionsnapshot · 2024-12-09 17:36 -
xnsbsjciylsg23zfmrv6ocuyh7ha5zexeouchlr3zsi5suda4arpeyqd.onionsnapshot · 2024-12-09 17:36 -
24y6h7fwi2fvlv2kuzudyiumjqz4rgqcml2wr7te6ugcgt6qatqe64yd.onionsnapshot · 2024-12-11 13:57 -
2plv344u23ebuayurqcfbjbnxpqzqknja3ca7ulbnnwtgb6tpmqqsvid.onionsnapshot · 2024-12-11 13:57 -
2udgodqyt6jn7s7cb7n66kaisg7i6gxo5n64tnvlk7dee4d4rguojbid.onionsnapshot · 2024-12-11 13:57 -
3bkgnqvrdlzib4t62oyo22eqljdrjaxtwcsvgwystog6yiyx7j7b7nad.onionsnapshot · 2024-12-11 13:57 -
3fgntkytua2jb7rarvuchns6ka7tfh3uc6ypub3ffepjq3jekb3eypyd.onionsnapshot · 2024-12-11 13:57 -
3g7cqn66j3uwes7jah744u6fzuzymvnlubn67624jwvswoollqkjtzqd.onionsnapshot · 2024-12-11 13:57 -
3id2g6u3dwvg7nsarfkgsdf3odp5hb7owvnoqbipbisekudptetuxtad.onionsnapshot · 2024-12-11 13:57 -
3kqfll43jsj7boglorh5xntudnynlk6howi6ks543cctlrnid4dzwdad.onionsnapshot · 2024-12-11 13:57 -
3md3it5uxkebudflmlratms66jvwkrdphzoo4nzsvwh63niqpz42aeyd.onionsnapshot · 2024-12-11 13:57 -
3oz6naflgy7gbtc4psqumk4dd7meq37tjxw7qxhytuiysyq3632xgsqd.onionsnapshot · 2024-12-11 13:57 -
3s5pzwlqllrzz4xlluholmqgueje7lutlugbdnwa3ehbedrxaq5wjbad.onionsnapshot · 2024-12-11 13:57 -
3xa42kwkeiwzhjybddfeifad7vn2kvsslybquledvib5xsfkylwtwyid.onionsnapshot · 2024-12-11 13:57 -
425yxsnocj47lwgueymn7y4y4vrphccooa3diabzoqdl6cslxriqxrqd.onionsnapshot · 2024-12-11 13:57 -
4kfzqzfci7uqpgngrosuukgj2dr745cyqgenbaojycdykgxipabnyqyd.onionsnapshot · 2024-12-11 13:57 -
4mncnm5bl3jfotcgrn7zv2uznfzs2oo4sahwrlqvwcd265x6jdudkcid.onionsnapshot · 2024-12-11 13:57 -
4qmsi7vcdrrutxapxbc7eofjjzfsvam3fehgmk6xyivwcroqkqjij5qd.onionsnapshot · 2024-12-11 13:57 -
5e2q3uzczl3bur23dxfxxu5unlukuqrlseesmxc7v7dmo4qgbr3kaxqd.onionsnapshot · 2024-12-11 13:57 -
5ety7tpkim5me6eszuwcje7bmy25pbtrjtue7zkqqgziljwqy3rrikqd.onionOshi - Anonymous file storage snapshot · 2025-05-23 09:03 -
5hhrba7et452bt3ttwqewumlua5t3vyyr27iomrv2o3ae6of3l7hghad.onionsnapshot · 2024-12-11 13:57 -
5igait2ocdf7kfktyemdgdl6cot43ryecr5ycqid6drydhpuzibu54qd.onionsnapshot · 2024-12-11 13:57 -
5rosrz5d53usc6p7s7qjvvcqv4bbedvpjsv3dzls7kuend2i65s7peqd.onionsnapshot · 2024-12-11 13:57 -
6lbwfgybggslvhkbsfqo427sqnfhutb65wmhvj5qlko32farj6w45qid.onionsnapshot · 2024-12-11 13:58
Recent victims
The 50 most recent victims claimed by ALPHV. Total in the index: 773.
| Date listed | Victim | Description |
|---|---|---|
| 2024-03-03 | ipmaltamira | Infraestructura Portuaria Mexicana S.A. de C.V. (IPM), subsidiary of P… |
| 2024-03-03 | Ewig Usa | Ewig Group is a one stop solution provider in electronic manufacturing… |
| 2024-03-02 | SBM & Co [You have 48 hours. Check your e-mail] | Established in 1993, we have many years of experience in assisting cli… |
| 2024-03-01 | SBM & Co | Established in 1993, we have many years of experience in assisting cli… |
| 2024-03-01 | Petrus Resources Ltd. | Petrus Resources Ltd. is a Canadian energy company active in property … |
| 2024-03-01 | Kumagai Gumi Group | Kumagai Gumi Co., Ltd. is a Japanese construction company founded in F… |
| 2024-02-29 | Allan Berger & Associates | Over the past four decades, Allan Berger has established himself as on… |
| 2024-02-28 | Change Healthcare - Optum - UnitedHealth | Two lies in one sentence - UnitedHealth has announced that the attack… |
| 2024-02-28 | verbraucherzentrale hessen | sample leaked data before official publication |
| 2024-02-27 | Electro Marteix | EMTEK is the trade name of the company ELECTRO MARTEIX, SL. We have a… |
| 2024-02-26 | Angeles Medical Centers | Angeles Medical Centers, a space dedicated to emotional and psychologi… |
| 2024-02-26 | S+C Partners | Refused to pay |
| 2024-02-24 | ANDFLA SRL | "ANDFLA's main activity is the commercialization of a variety of agric… |
| 2024-02-24 | Family Health center | Since Moses L. Walker and his colleagues opened the doors for the firs… |
| 2024-02-24 | Worthen Industries [FULL DATA] | Chemical manufacturing. |
| 2024-02-22 | Hardeman County Community Health Center | Hardeman County Community Health Center (HCCHC) is a Non-Profit Federa… |
| 2024-02-22 | Worthen Industries [We're giving you one last chance to save your business] | Worthen Industries - a company with 150 years of history specializing … |
| 2024-02-21 | KHSS (You have 3 days) | KHS&S is transforming construction from a field-based industry to an i… |
| 2024-02-21 | Austen Consultants | IT Consultings Cloud Phone Anti-Ransomware Encrypted network |
| 2024-02-18 | VSP Dental | Top Cosmetic & Implant Dentist in South-Central Virginia Dr. Patel is … |
| 2024-02-17 | LoanDepot | LoanDepot, is an Irvine, California-based nonbank holding company whic… |
| 2024-02-16 | Prudential Financial | Prudential Financial, Inc. is an American Fortune Global 500 and Fortu… |
| 2024-02-15 | Rush Energy Services Inc [Time's up] | Rush Energy Services Inc. develops a network of crude oil custom treat… |
| 2024-02-15 | ASA Electronics [2.7 TB] | ASA Electronics® has been designing and manufacturing mobile electroni… |
| 2024-02-13 | ArcisGolf | Arcis Golf is the premier operator of nearly 70 private, resort, and p… |
| 2024-02-13 | Trans-Northern Pipelines | Trans-Northern Pipelines Inc. (TNPI) operates regulated pipelines in c… |
| 2024-02-13 | The Source | The Source Electronics Inc., doing business as The Source, is a Canadi… |
| 2024-02-13 | Herrs | Herr's is an American brand of potato chips and other snack foods prod… |
| 2024-02-13 | Procopio | At Procopio, we strive to provide the highest level of client service.… |
| 2024-02-13 | New Indy Containerboard | A joint venture between The Kraft Group and Schwarz Partners LP was fo… |
| 2024-02-12 | Rush Energy Services Inc [You have 48 hours] | Rush Energy Services Inc. develops a network of crude oil custom treat… |
| 2024-02-12 | SERCIDE | CIDE has representation in around 600 municipalities distributed throu… |
| 2024-02-12 | Lower Valley Energy, Inc. | Full data dump available. USA phones: AFTON (307) 885-3175 JACKSON (30… |
| 2024-02-10 | maddockhenson | OUR MISSION It is our mission to help businesses and individuals prosp… |
| 2024-02-09 | Grace Lutheran Foundation | Grace Lutheran Foundation Inc. is an organization who offers many area… |
| 2024-02-08 | Jewish Home Lifecare | Phone Number (212) 870-5000 Headquarters 120 W 106th St, New York City… |
| 2024-02-05 | Vail-Summit Orthopaedics & Neurosurgery (VSON) | At Vail-Summit Orthopaedics & Neurosurgery, we are dedicated to provid… |
| 2024-01-31 | SportsMEDIA Technology | SportsMEDIA Technology (SMT) is a developer and provider of sports tec… |
| 2024-01-31 | LeClair Group | 6701 Upper Afton Rd, Saint Paul, Minnesota, 551... Phone Number(877) 5… |
| 2024-01-31 | Hydraflow | 1881 W Malvern Ave, Fullerton, California, 9283... Phone Number (714) … |
| 2024-01-30 | TECHNICA - HACKED AND MORE THEN 300 GB DATA LEAKED! | Technica Dulles, VA (HQ) 22970 Indian Creek Drive, Suite 500 Dulles, V… |
| 2024-01-29 | Dutton Brock | Founded in 1982, Dutton Brock is an insurance litigation firm. Its pra… |
| 2024-01-26 | Draneas Huglin Dooley LLC | Draneas Huglin Dooley LLC is an experienced law firm that has an excep… |
| 2024-01-25 | Brightstar Care | BrightStar Care was founded over 20 years ago on the belief that the b… |
| 2024-01-24 | FULL LEAK! Busse & Busee, PC Attorneys at Law | LEAKED! |
| 2024-01-24 | MBC Law Professional Corporation | MBC Law Professional Corp is a company that operates in the Legal Serv… |
| 2024-01-23 | Herrs (You have 72 hours) | Herr's is an American brand of potato chips and other snack foods prod… |
| 2024-01-23 | Total Air Solutions | Total Air Solutions provides residential and commercial HVAC services … |
| 2024-01-22 | ANS COMPUTER [72hrs] | Since 2001, A.N.S. computer has become a company active in the marketi… |
| 2024-01-20 | Worthen Industries [You have three days] | Worthen Industries Chemicals & Related Products · New Hampshire, Uni… |
CONFIRMED ATTACKS
ALPHV confirmed attacks: 217 verified incidents
Ransomnews has verified 217 ALPHV incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from November 2021 to March 2024. United States accounts for 124 of them (57%), with victims recorded in 38 countries in total. The most affected sector is healthcare, at 33 confirmed victims. A ransom payment was publicly confirmed in 3 cases and publicly refused in 31; the outcome is unrecorded in the remaining 183. Where a figure was disclosed (91 cases), these incidents account for 274,657,227 exposed records.
217Verified incidents
38Countries
2021–2024Active range
9%Paid, where outcome known
Confirmed victims by year
Most affected sectors
Most affected countries
Verified ALPHV incidents (100 most recent of 217)
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| March 2024 | Administradora de Subsidios Sociales (ADESS) | Government | Santo Domingo, Dominican Republic | — | Unknown | Source |
| February 2024 | Verbraucherzentrale Hessen (Hessen Consumer Center) | Other | Frankfurt, Germany | — | Unknown | Source |
| February 2024 | Change Healthcare | Healthcare | Tennessee, United States | 192,700,000 | Yes | Source |
| February 2024 | Prudential Insurance Company of America | Finance | New Jersey, United States | 2,556,210 | Unknown | Source |
| January 2024 | Kumagai Gumi Co., Ltd. | Construction | Tokyo, Japan | — | Unknown | Source |
| January 2024 | Family Health Center | Healthcare | Michigan, United States | 34,926 | Unknown | Source |
| January 2024 | Jewish Home Lifecare d/b/a The New Jewish Home | Healthcare | New York, United States | 104,234 | Unknown | Source |
| January 2024 | Vail Summit Orthopaedics & Neurosurgery | Healthcare | Colorado, United States | 1,138 | Unknown | Source |
| January 2024 | Grace Lutheran Communities | Healthcare | Wisconsin, United States | — | No | Source |
| January 2024 | LoanDepot | Finance | California, United States | 16,924,071 | No | Source |
| December 2023 | Prefeitura Municipal de Itabira | Government | Itabira, Brazil | — | Unknown | Source |
| December 2023 | Ursel Phillips Fellows Hopkinson LLP | Legal | Torono, Canada | — | Unknown | Source |
| December 2023 | Triella | Technology | Torono, Canada | — | Unknown | Source |
| December 2023 | Lower Valley Energy, Inc. | Utilities | Wyoming, United States | — | Unknown | Source |
| December 2023 | Navigation Financial Advisors, Inc. (Navigation Financial Group) | Finance | Texas, United States | 3,996 | Unknown | Source |
| December 2023 | Ultra Intelligence & Communications | Technology | Texas, United States | — | Unknown | Source |
| December 2023 | VF Corporation | Retail | Colorado, United States | 35,500,000 | Unknown | Source |
| December 2023 | HTC Global Services | Technology | Michigan, United States | — | Unknown | Source |
| November 2023 | Nakajima Manufacturing Co., Ltd. | Manufacturing | Nagano, Japan | — | Unknown | Source |
| November 2023 | Arcis Golf | Other | Texas, United States | 53,334 | Unknown | Source |
| November 2023 | New-Indy Containerboard, LLC | Manufacturing | California, United States | 874 | Unknown | Source |
| November 2023 | Trans-Northern Pipelines, Inc. | Utilities | Ontario, Canada | — | Unknown | Source |
| November 2023 | Lanbide | Government | Vitoria-Gasteiz, Spain | 140,000 | Unknown | Source |
| November 2023 | MeridianLink | Technology | California, United States | — | Unknown | Source |
| November 2023 | Henry Schein | Healthcare | New York, United States | — | Unknown | Source |
| November 2023 | Naftor Sp. z o.o. | Service | Warsaw, Poland | — | Unknown | Source |
| November 2023 | PriceSmart | Retail | California, United States | — | Unknown | Source |
| November 2023 | Deutsche Energie-Agentur (dena) | Government | Berlin, Germany | — | No | Source |
| November 2023 | Japan Aviation Electronics | Manufacturing | Tokyo, Japan | — | Unknown | Source |
| November 2023 | Fidelity National Financial | Finance | Florida, United States | 1,316,938 | Unknown | Source |
| October 2023 | Nationstar Mortgage LLC (dba Mr. Cooper) | Finance | Texas, United States | 14,690,284 | Yes | Source |
| October 2023 | ASM Global Parent, Inc. | Other | California, United States | 4,634 | Unknown | Source |
| October 2023 | Mariposa Landscapes, Inc. | Construction | California, United States | 8,131 | Unknown | Source |
| October 2023 | Cottrell and McCullough Dental | Healthcare | New York, United States | — | Unknown | Source |
| October 2023 | Gnome, Inc. dba Gnome Landscapes | Service | Maine, United States | 39 | Unknown | Source |
| October 2023 | St. Lucie County Tax Collector | Government | Florida, United States | 25,202 | No | Source |
| October 2023 | Advarra | Healthcare | Maryland, United States | 31,233 | Unknown | Source |
| October 2023 | Corsica Ferries | Transportation | Bastia, France | — | No | Source |
| October 2023 | Town of Iowa | Government | Louisiana, United States | — | Unknown | Source |
| October 2023 | First Judicial Circuit Court | Government | Florida, United States | — | Unknown | Source |
| September 2023 | Yusen Logistics Co., Ltd. | Transportation | Tokyo, Japan | — | Unknown | Source |
| September 2023 | Bermuda Government | Government | Hamilton, Bermuda | — | Unknown | Source |
| September 2023 | Wyndemere Senior Care LLC | Healthcare | Illinois, United States | 6,846 | Unknown | Source |
| September 2023 | Prestige Care | Healthcare | Washington, United States | 116,956 | Unknown | Source |
| September 2023 | Empresa Nacional de Distribuição de Electricidade (ENDE) | Government | Luanda, Angola | — | Unknown | Source |
| September 2023 | GC Services | Finance | Texas, United States | 3,043 | Unknown | Source |
| September 2023 | FEAM Aero | Service | Florida, United States | — | Unknown | Source |
| September 2023 | Henry Schein | Healthcare | New York, United States | 166,432 | Unknown | Source |
| September 2023 | City of Pittsburg | Government | Kansas, United States | — | Unknown | Source |
| September 2023 | Morrison Community Hospital | Healthcare | Illinois, United States | 122,488 | Unknown | Source |
| September 2023 | Cadre | Service | Wisconsin, United States | — | No | Source |
| September 2023 | Phil-Data Business Systems, Inc. | Technology | Makati City, Philippines | — | Unknown | Source |
| September 2023 | Barry Plant Real Estate | Service | Doncaster East, Australia | — | Unknown | Source |
| September 2023 | Strata Plan | Service | Melbourne, Australia | — | No | Source |
| September 2023 | Motel One | Other | Munich, Germany | — | Unknown | Source |
| September 2023 | Furtwangen University | Education | Furtwangen, Germany | — | Unknown | Source |
| September 2023 | Progressive Leasing | Finance | Utah, United States | 193,055 | Unknown | Source |
| September 2023 | QSI, Inc. (Quality Service Installation) | Finance | Kentucky, United States | 785 | Unknown | Source |
| August 2023 | Wilder & Co, CPA | Finance | Pennsylvania, United States | 1,797 | Unknown | Source |
| August 2023 | MNGI Digestive Health | Healthcare | Minnesota, United States | 767,670 | Unknown | Source |
| August 2023 | Pik Rite, Inc. | Manufacturing | Pennsylvania, United States | 404 | Unknown | Source |
| August 2023 | American University of Antigua College of Medicine | Education | Osbourn, Antigua | 337 | Unknown | Source |
| August 2023 | Brooklyn Premier Orthopedics | Healthcare | New York, United States | 48,459 | Unknown | Source |
| August 2023 | Derrimon Trading Co. Ltd. | Food and Beverage | Kingston, Jamaica | — | No | Source |
| August 2023 | Mole Valley Farmers | Food and Beverage | South Molton, United Kingdom | — | Unknown | Source |
| August 2023 | Core Desktop | Technology | Melbourne, Australia | — | Unknown | Source |
| August 2023 | Freeport-McMoRan | Manufacturing | Arizona, United States | 1,327 | Unknown | Source |
| July 2023 | Atlantic Federal Credit Union | Finance | Maine, United States | — | Unknown | Source |
| July 2023 | Wright, Moore, DeHart, Dupuis & Hutchinson, LLC | Finance | Louisiana, United States | 127,431 | Unknown | Source |
| July 2023 | Highland Health Systems | Healthcare | Alabama, United States | 83,543 | Unknown | Source |
| July 2023 | Campbell Killin Brittan & Ray, LLC | Legal | Colorado, United States | 4,448 | Yes | Source |
| July 2023 | Superior Communications, Inc. | Manufacturing | California, United States | — | Unknown | Source |
| July 2023 | Estée Lauder | Manufacturing | New York, United States | 150,511 | Unknown | Source |
| July 2023 | McLaren Health Care | Healthcare | Michigan, United States | 2,192,515 | Unknown | Source |
| July 2023 | Corporación Radio e Televisión de Galicia (CRTVG) | Other | A Coruña, Spain | — | Unknown | Source |
| July 2023 | SEIKO NPC Corporation | Manufacturing | Tokyo, Japan | 60,000 | Unknown | Source |
| July 2023 | Tempur Sealy International | Manufacturing | Kentucky, United States | — | Unknown | Source |
| July 2023 | Caja Popular Mexicana | Finance | Guanajuato, Mexico | — | Unknown | Source |
| July 2023 | CF Assicurazioni SpA | Finance | Rome, Italy | — | Unknown | Source |
| June 2023 | Saint Xavier University | Education | Illinois, United States | 212,267 | Unknown | Source |
| June 2023 | Bartlett Dairy, Inc. | Food and Beverage | New York, United States | 5,493 | Unknown | Source |
| June 2023 | Kansas Joint & Spine Specialists | Healthcare | Kansas, United States | 83,869 | Unknown | Source |
| June 2023 | Kimco Staffing Services, Inc. | Service | California, United States | 69,687 | Unknown | Source |
| June 2023 | Plot Corporation | Technology | Osaka, Japan | — | No | Source |
| June 2023 | ITW Food Equipment Group, LLC | Manufacturing | Ohio, United States | 290 | Unknown | Source |
| June 2023 | Cordell & Cordell | Legal | Missouri, United States | 368 | Unknown | Source |
| June 2023 | Beverly Hills Plastic Surgery | Healthcare | California, United States | — | Unknown | Source |
| June 2023 | Barts Health NHS Trust | Healthcare | London, United Kingdom | — | Unknown | Source |
| June 2023 | Townsquare Media | Other | New York, United States | — | Unknown | Source |
| June 2023 | Automatic Systems | Manufacturing | Wavre, Belgium | — | Unknown | Source |
| June 2023 | Azimut Group | Finance | Milan, Italy | — | No | Source |
| June 2023 | Krishi Bank | Finance | Dhaka, Bangladesh | — | No | Source |
| June 2023 | National Institutional Facilitation Technologies | Finance | Karachi, Pakistan | — | Unknown | Source |
| June 2023 | FIIG Securities | Finance | Brisbane, Australia | — | Unknown | Source |
| May 2023 | The Dufresne Spencer Group, LLC | Retail | Tennessee, United States | 61,744 | Unknown | Source |
| May 2023 | Burch & Cracchiolo, PA | Legal | Arizona, United States | — | Unknown | Source |
| May 2023 | Houser, LLP | Legal | California, United States | 370,001 | Unknown | Source |
| May 2023 | Ascendum Machinery, Inc. | Service | North Carolina, United States | — | Unknown | Source |
| May 2023 | It Works Marketing, Inc. | Retail | Florida, United States | 301 | Unknown | Source |
| May 2023 | Silicon Valley Mechanical, Inc. | Construction | California, United States | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from ALPHV's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.