AMS-Gruppe Listed by alphv Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
The AMS-Gruppe Listed by alphv Ransomware Group (reported May 31, 2022) is an unverified claim; the data involved is undisclosed belonging to roughly unknown people. If you have an account with them, your information may now be circulating on the open web and with data brokers. Here’s exactly what happened, how to check if you were affected, and what to do next.
What happened
The incident came to public notice when alphv added AMS-Gruppe to its data-leak site on 31 May 2022. The group claims to have obtained internal files through a ransomware operation. No further technical details, such as the initial access method, encryption status, or timeline of the intrusion, have been disclosed by either the organisation or the threat actor.
Public records do not show any official statement from AMS-Gruppe confirming or denying the claims. The number of people whose information may be involved remains unknown.
Who is alphv?
Alphv, also tracked publicly as BlackCat, is a ransomware-as-a-service operation that emerged in late 2021. The group supplies encryption tools to affiliate attackers and typically follows a double-extortion model: data is both encrypted on victim systems and copied for later publication if a ransom demand is not met. Alphv has appeared in multiple public incident reports involving organisations across Europe and North America.
Its leak-site listings function as a pressure tactic. The group publishes file samples or directory listings to demonstrate possession of material, though independent verification of the contents or the circumstances of acquisition is rarely possible from public sources alone.
About AMS-Gruppe
AMS-Gruppe operates as a leasing provider focused on mobility solutions. Its services include arrangements for passenger cars, bicycles, e-bikes and IT equipment such as tablets and smartphones. The company describes a “double-deck leasing” model in which contractual rights and obligations are divided between an employer and an employee, often in connection with salary conversion or staff-motivation programmes.
Organisations of this type routinely process customer contracts, financial details, vehicle registration data and employment-related records. A compromise therefore touches both corporate operations and the personal information of individuals who have entered leasing agreements.
What was likely exposed
The only detail released is that internal files were allegedly exfiltrated. The precise categories of data contained in those files have not been published. Organisations engaged in vehicle and equipment leasing commonly hold names, addresses, contact information, contract terms, payment records and, in some cases, employer-linked payroll data. Whether any of these categories are present in the material claimed by alphv is unconfirmed.
Why it matters
Leasing records can contain long-term financial commitments and personal identifiers that remain useful for identity-related fraud or targeted scams long after the original agreement ends. Employers participating in salary-conversion schemes may also see aggregated workforce data exposed. For the company itself, the incident adds operational disruption and potential regulatory obligations under data-protection law.
Because the scale of the data set is undisclosed, the extent of any downstream risk cannot be quantified from available information.
If your data was in this claimed breach
Individuals who have held leasing contracts with AMS-Gruppe or similar providers should monitor bank and credit accounts for unusual activity and consider placing fraud alerts with credit reference agencies. Changing passwords on any associated online portals and enabling multi-factor authentication are standard precautions.
Readers can run a free exposure scan of their email address against known breach data sets to check whether their information appears in publicly reported incidents.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
STRESSER ASSOCIATES CPA Listed by alphv Ransomware GroupCENTRAL BANK OF GAMBIA HACKED 2 TB OF CRITICAL DATA WAS STOLEN Listed by alphv Ransomware GroupThe People's Federal Credit Union | tpfcucom Listed by alphv Ransomware GroupDC ADVISORY Listed by alphv Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the AMS-Gruppe Listed by alphv Ransomware Group →
Publicly posted by alphv — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.