ALPHV
Data as of August 16, 2026.
Credential exposure before the attack
13.8% of ALPHV victims whose domain we can identify (113 of 817) had employee credentials leak in the 12 months before ALPHV named them as a victim.
We don't know whether any of these credentials were how ALPHV gained initial access.
What industries ALPHV targets
Sector identified for 423 of 818 victims.
| Financial Services | 141 | |
| Manufacturing | 48 | |
| Healthcare | 41 | |
| Legal | 40 | |
| Construction | 24 | |
| Energy | 21 | |
| Education | 20 | |
| Technology | 17 |
Where the victims are located
Country identified for 202 of 818 victims.
| United States | 27 | |
| Australia | 20 | |
| United Kingdom | 16 | |
| Canada | 14 | |
| Germany | 14 | |
| Brazil | 11 | |
| Italy | 10 | |
| Japan | 10 |
Most recent ALPHV victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Ewig Group ewig-mco.com | Manufacturing | Not identified | Mar 4, 2024 |
| Mexican Port Infrastructure ipmaltamira.com.mx | Not identified | Mexico | Mar 4, 2024 |
| Kumagai Gumi kumagaigumi.co.jp | Construction | Japan | Mar 4, 2024 |
| Petrus petrusresources.com | Energy | Canada | Mar 4, 2024 |
| SBM sbmco.in | Not identified | India | Mar 4, 2024 |
| Allan Berger bergerlawnola.com | Legal | Not identified | Mar 1, 2024 |
| Electro Marteix emtek.es | Telecommunications | Spain | Feb 28, 2024 |
| Verbraucherzentrale Hessen verbraucherzentrale-hessen.de | Financial Services | Germany | Feb 28, 2024 |
| Angeles Mental Health angelesmentalhealth.com | Not identified | Not identified | Feb 27, 2024 |
| S+C Partners scpllp.com | Financial Services | Not identified | Feb 27, 2024 |
| ANDFLA andfla.ro | Agriculture | Romania | Feb 26, 2024 |
| Family Health Center fhckzoo.com | Healthcare | Not identified | Feb 26, 2024 |
| Hardeman County Community Health Center hardemanhealth.org | Not identified | Not identified | Feb 23, 2024 |
| Austen austein-it.com | Technology | Not identified | Feb 22, 2024 |
| KHS&S khss.com | Construction | Not identified | Feb 22, 2024 |
| Delia delia.pl | Not identified | Poland | Feb 19, 2024 |
| Grace Lutheran Communities graceluthfound.com | Healthcare | Not identified | Feb 19, 2024 |
| loanDepot.com loandepot.com | Retail | Not identified | Feb 19, 2024 |
| Loan Depot loandepot.com | Retail | Not identified | Feb 19, 2024 |
| Prudential prudential.com | Financial Services | United States | Feb 19, 2024 |
Showing the 20 most recent of 818. Browse recent data breaches for more.
ALPHV leak sites
Addresses we've seen ALPHV publish victims from. Any .onion address needs the Tor Browser.
alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onionamnwxasjtjc6e42siac6t45mhbkgtycrx5krv7sf5festvqxmnchuayd.onionalphvuzxyxv6ylumd2ngp46xzq3pw6zflomrghvxeuks6kklberrbmyd.onionanonfiles.commega.nzwww.sendspace.comalphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion.wsvqifktlreqpudvulhbzmc5gocbeawl67uvs2pttswemdorbnhaddohyd.onionlockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onionieflygyfoezms2wshjpfyfz4hpyxjcdtxejntysvopd7n7cmmnucbkad.onion2cuqgeerjdba2rhdiviezodpu3lc4qz2sjf4qin6f7std2evleqlzjid.onionmebtrazi6iyyb3jflqcrdvnn7hv5l4e6w3fyu3noyha2o2jaxj2kzwid.oniondropmefiles.comjh6c5paotsistqh2u5ias3nx2kdb3brkbwz6xhclivtzsdq5h4xyshid.onion3nnwjjrje6lpisqybb3n2qvplv3fjokwc3qrx764a4lbvgyjmcbbveid.onionchygou6fs4nu2r56ncfd3crjb62s6sysulg7y7ds2tbdoa4d3wcwrdyd.onionalphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion.lywake57gge7jfbrjssm65yac6fewan5nth5hhlcg7lorvmpxsnknf4xqd.onionbmebpteoa53k76zoiafykh4axr4kzbx7jn2djvdrdde4r57bckkfxsyd.onionxqclaoqanufx6z77e3ieun4xvmrsenolxjhhvlk56yfncuke66myfsqd.onion3g7cqn66j3uwes7jah744u6fzuzymvnlubn67624jwvswoollqkjtzqd.oniongevvr5kripac4p52ixiq3ufnkr4qasn64r5d7fsyu3kk2zmuyarbvdad.onionyh4vjsv3u27zlzosrsjc5aveua3iclhifjmwdr5uujsaqz7hfkkljfid.onion5hhrba7et452bt3ttwqewumlua5t3vyyr27iomrv2o3ae6of3l7hghad.oniondr2tr76ftudjccp4zc7fks5lhk3pg3rifl3rcc36bgm46sfivkq2sfqd.onion
ALPHV questions
Is ALPHV still active?
Not for over a year. The last victim we recorded was March 4, 2024. The leak site has published nothing since, though the data it already leaked is still out there.
How many victims has ALPHV claimed?
ALPHV has named 818 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did ALPHV first appear?
The first victim we recorded for ALPHV was posted on November 30, 2021. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does ALPHV target?
Financial Services accounts for the most victims we can classify, with 141. Manufacturing follows at 48. We could identify a sector for 423 of 818 victims, so treat this as the shape of the targeting rather than a full census.
Has ALPHV already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.