ALB Forex Listed by datacarry Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who trade or hold accounts with ALB Forex may be wondering whether their personal or financial details have been taken. On 25 October 2024 the company was listed by the ransomware group datacarry, which claims to have exfiltrated internal files. The number of people affected remains unknown, and public detail on exactly what was taken is limited. For anyone whose data may be involved, the practical stakes are clear: financial-services records can be used for fraud, account takeover or targeted scams, so understanding what is known—and what is not—matters more than speculation.

This article sets out only the What's Publicly Reported of the listing, places them in the context of the organisation and the threat actor, and outlines the real-world risks and first steps for those who may be exposed.

What happened

On 25 October 2024 ALB Forex was listed on the leak site associated with the datacarry ransomware group. The group claims that internal files were exfiltrated in a ransomware attack. No further public detail has been released about the date the intrusion began, how access was obtained, the volume of data taken, or whether systems were encrypted. The number of people affected is unknown. At present the listing itself is an unverified claim by the group; independent confirmation of the breach’s full scope has not been published in the available record.

Who is datacarry?

datacarry is a ransomware operation that has appeared in public threat reporting as a group that steals data before or alongside encryption and then lists victims on a dedicated leak site to pressure payment. Like other double-extortion actors, it typically claims to hold stolen files and threatens to publish them if a ransom is not paid. Public reporting has associated the group with opportunistic targeting of organisations across multiple sectors rather than a single industry focus. Its listings are claims made by the operators; they do not by themselves constitute independent verification of every detail asserted about a given victim. In this case, the only specific assertion tied to ALB Forex in the available facts is that internal files were exfiltrated.

Who is ALB Forex?

ALB Forex is a financial-services company based in Turkey that specialises in forex trading. It provides individual and corporate investors with access to the foreign-exchange market, offering online trading platforms, professional training and market analysis. Firms of this type routinely hold customer identity documents, contact details, trading account information, transaction histories and, in many cases, banking or payment data needed to fund and settle trades. Because the company operates in a regulated financial sector and handles sensitive client records, any confirmed compromise of internal systems can have consequences both for the organisation’s regulatory standing and for the people whose data it processes. The available facts do not state that ALB Forex has confirmed the incident or described its own investigation.

What was likely exposed

The facts state only that internal files were exfiltrated in a ransomware attack. No inventory of file names, databases or data categories has been published. Organisations that provide forex trading services typically maintain records that can include names, addresses, national identification numbers, email addresses, phone numbers, account credentials, trade logs, deposit and withdrawal details, and internal corporate documents such as contracts, employee information or system configurations. Whether any of those categories were among the files claimed by datacarry is unconfirmed. Readers should treat the precise contents as unknown until the company or independent investigators release verified details.

The real-world impact

For individuals, the main risks are financial fraud and social-engineering attacks. Stolen identity or account data can be used to attempt unauthorised trades, open new accounts elsewhere, or craft convincing phishing messages that reference real trading activity. Corporate clients face similar exposure of commercial relationships and payment details. For ALB Forex itself, a claimed ransomware incident can bring operational disruption, regulatory scrutiny, notification obligations and reputational damage, even if the full technical impact remains undisclosed. Because the scale of the alleged exfiltration is unknown, it is not possible to quantify how many people or accounts may be affected; the prudent assumption for anyone who has used the service is that their information could be among the internal files claimed by the group.

What to do if you're exposed

If you hold or have held an account with ALB Forex, treat the listing as a reason to take basic protective steps while further information is awaited. Concrete actions include:

• Change passwords on your ALB Forex account and any other services where you reused the same credentials; enable multi-factor authentication wherever it is offered.
• Monitor bank and trading statements for unexpected transfers or trades and report anomalies immediately to both the financial institution and ALB Forex.
• Be alert to phishing or phone calls that reference your trading history or claim to be from the company; verify any request through official channels you already trust.
• Consider placing fraud alerts with credit-reference agencies if identity documents may have been involved, and keep records of any suspicious contact.
• Run a free exposure scan of your email address against known breach data sets to see whether your address has already appeared in public dumps; this does not confirm involvement in this specific incident but can surface other exposures that need attention.

Public detail remains limited. Continue to watch for official statements from ALB Forex and treat any claim of “full data release” by the ransomware group as unverified until independently corroborated. Early, calm action reduces the chance that stolen information can be used successfully against you.

AICompiled with AI assistance from public sources and published under our editorial standards.