AlohaABA Listed by avaddon Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
The AlohaABA Listed by avaddon Ransomware Group (reported September 9, 2021) is an unverified claim; the data involved is undisclosed belonging to roughly unknown people. If you have an account with them, your information may now be circulating on the open web and with data brokers. Here’s exactly what happened, how to check if you were affected, and what to do next.
Ransomware groups have increasingly adopted a double-extortion model in which data is exfiltrated before encryption, then threatened with public release if a ransom is not paid. This tactic expanded notably in 2020 and 2021 as operators maintained dedicated leak sites to pressure victims. On 9 September 2021, AlohaABA appeared on one such site operated by the Avaddon group.
Public information about the event remains limited. The number of individuals affected has not been disclosed, and the precise contents of any exfiltrated material have not been published or independently verified beyond the group’s listing.
Inside the incident
The only confirmed public detail is that AlohaABA was listed on the Avaddon ransomware leak site on 9 September 2021. The group claims to have stolen internal files during a ransomware attack. No figure for the volume of data, the number of people potentially impacted, or the timeline of the intrusion has been released by the organization or by investigators. The listing itself constitutes the group’s assertion; independent confirmation of the data’s authenticity or scope has not been made public.
Who is avaddon?
Avaddon operated as a ransomware-as-a-service group that provided encryption tools to affiliates in exchange for a share of ransom payments. Like several contemporaneous operators, it relied on a leak site to publish samples or directories of data taken from organizations that declined to pay. The group was publicly active from roughly mid-2020 through 2021 and followed the pattern of encrypting systems while also threatening to disclose exfiltrated material. Its infrastructure was later disrupted through coordinated law-enforcement action, though the specific claims made against individual victims were never adjudicated in public court records.
Who is AlohaABA?
AlohaABA provides applied behavior analysis services, a form of therapy commonly delivered to individuals with autism spectrum disorder and other developmental conditions. Organizations in this sector routinely collect and store detailed clinical notes, progress records, family contact information, and insurance or billing data. Because the work involves minors and people receiving health-related support, the records are subject to both general data-protection expectations and sector-specific privacy rules. A compromise at such an organization therefore raises questions about the handling of sensitive personal and health information even when the exact records involved remain undisclosed.
The information in question
The only description released is that “internal files” were allegedly exfiltrated. No inventory of file types, patient identifiers, or other categories has been published. Organizations that deliver behavioral-health services typically maintain assessment reports, session notes, guardianship documents, and financial or insurance records; however, whether any of these categories were present in the material claimed by the group is unconfirmed. The exact contents therefore remain unknown to the public.
What's at stake
Even without a confirmed list of exposed fields, internal files from a therapy provider can contain information that is difficult to change, such as detailed behavioral histories or diagnostic notes. Individuals whose records are involved may face risks of unwanted disclosure, targeted scams, or complications with insurers or schools. For the organization, the incident adds operational costs for investigation, potential regulatory review, and the need to strengthen access controls and monitoring. The absence of a published count of affected people leaves the scale of these consequences unclear.
What to do if you're exposed
Anyone who received services from AlohaABA or who supplied personal information to the organization should monitor their health-insurance statements, credit reports, and email accounts for unusual activity. Changing passwords on any associated portals and enabling multi-factor authentication where available are standard first steps. Individuals can also run a free exposure scan of their email address against known breach data sets to determine whether their information has appeared in previously published collections.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Accounts IQ Listed by avaddon Ransomware GroupSyndex Listed by avaddon Ransomware GroupCarlos Federspiel & Co SA Listed by avaddon Ransomware GroupServilex Advocaten Listed by avaddon Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the AlohaABA Listed by avaddon Ransomware Group →
Publicly posted by avaddon — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.