alloha.com Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
alloha.com appeared on a data-leak site operated by thegentlemen ransomware group on 4 April 2026, with internal files reported as exfiltrated. Anyone who has used the service should check for official notices and consider changing passwords or enabling additional security steps.
Breaking down the breach
The incident was reported on April 04, 2026, through a listing on the threat actor’s site. The only confirmed element is that internal files were taken in a ransomware operation. No information has been released on the date of the intrusion, the method of initial access, the quantity of data involved, or whether any data was subsequently published.
The group behind it: thegentlemen
Thegentlemen is a ransomware operation that maintains a leak site to list victims and, in some cases, release stolen material. The group typically uses encryption alongside data exfiltration to pressure targets. Its listing of alloha.com constitutes a claim by the actor; independent confirmation of the intrusion or the data taken has not been provided.
About alloha.com
Alloha is the largest independent fiber-to-the-home operator in Brazil. Founded in 2018 and based in São Paulo, the company operates more than 140,000 km of optical fiber and provides service to approximately 1.5 million customers across 280 cities. As a telecommunications provider it holds network infrastructure records and customer account information.
What data was at risk
The listing refers only to “internal files.” The precise categories of data involved have not been disclosed. Telecommunications operators routinely maintain customer names, addresses, service details, billing records, and network configuration information, but it is not confirmed whether any of these categories were among the files taken.
The real-world impact
Exfiltrated internal files can expose operational details that affect service continuity for the company and its customers. If personal or account data is present, affected individuals face the possibility of targeted fraud or account misuse. The organization must manage incident response, potential regulatory obligations, and restoration of systems while the scope of exposure remains unclear.
Were you affected?
Individuals can review account statements and monitor for unusual activity. Checking whether an email address appears in known breach data through a free exposure scan provides one practical starting point. Organizations in similar sectors should verify that incident-response plans address both encryption and data-exfiltration scenarios.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Bell Hardware Listed by thegentlemen Ransomware GroupBrian Jessel BMW Listed by thegentlemen Ransomware GroupYMCA of Columbia Listed by thegentlemen Ransomware GroupHarlem Stage Listed by thegentlemen Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the alloha.com Listed by thegentlemen Ransomware Group →
Publicly posted by thegentlemen — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.