ALP-001
Data as of August 16, 2026.
What industries ALP-001 targets
Sector identified for 12 of 15 victims.
| Manufacturing | 3 | |
| Telecommunications | 2 | |
| Logistics | 2 | |
| Technology | 2 | |
| Media | 2 | |
| Government | 1 |
Where the victims are located
Country identified for 14 of 15 victims.
| France | 3 | |
| United States | 2 | |
| China | 1 | |
| Sweden | 1 | |
| Italy | 1 | |
| Japan | 1 | |
| Canada | 1 | |
| Slovakia | 1 |
Every ALP-001 victim
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Knewin knewin.com | Not identified | Brazil | Apr 13, 2026 |
| KOB 4 kob.com | Media | United States | Apr 13, 2026 |
| Lacor lacor.es | Manufacturing | Spain | Apr 13, 2026 |
| Aviwest aviwest.com | Media | France | Apr 10, 2026 |
| Inatech inatech.com | Logistics | United Kingdom | Apr 10, 2026 |
| NEP Group nepgroup.com | Not identified | United States | Apr 10, 2026 |
| Artmotion artmotion.net | Telecommunications | Not identified | Apr 6, 2026 |
| Asseco Central Europe asseco-ce.com | Technology | Slovakia | Apr 6, 2026 |
| Iliad iliad.fr | Telecommunications | France | Mar 31, 2026 |
| Terix terix.com | Technology | Canada | Mar 30, 2026 |
| JAXA jaxa.jp | Government | Japan | Mar 27, 2026 |
| Esprinet esprinet.com | Logistics | Italy | Mar 26, 2026 |
| Hikvision hikvision.com | Not identified | China | Mar 23, 2026 |
| IRCO Automation irco.com | Manufacturing | Sweden | Mar 23, 2026 |
| Pellenc Group pellenc.com | Manufacturing | France | Mar 23, 2026 |
Browse recent data breaches for more.
ALP-001 leak site
The address we've seen ALP-001 publish victims from. Any .onion address needs the Tor Browser.
b4riuxx7ypobdptctf6lyfcvgi6vn74iurzdh4kn2agbk7472dvywgyd.onion
ALP-001 questions
Is ALP-001 still active?
It's gone quiet. The last victim we recorded was April 13, 2026, and nothing has appeared since. Groups do go quiet and come back, so we're still watching.
How many victims has ALP-001 claimed?
ALP-001 has named 15 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did ALP-001 first appear?
The first victim we recorded for ALP-001 was posted on March 23, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does ALP-001 target?
Manufacturing accounts for the most victims we can classify, with 3. Telecommunications follows at 2. We could identify a sector for 12 of 15 victims, so treat this as the shape of the targeting rather than a full census.
Has ALP-001 already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.