Andalusia Group Listed by alphv Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations worldwide by pairing system encryption with the theft and threatened publication of internal data. Listings on criminal leak sites have become a routine feature of this landscape, often appearing before independent confirmation of what was taken or how many people may be involved. Against that backdrop, the appearance of Andalusia Group on a site associated with the alphv ransomware operation in late September 2023 fits a familiar pattern of claimed double-extortion attacks.

Public reporting on 29 September 2023 stated that Andalusia Group had been listed by alphv, with the claim that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and many operational details have not been disclosed. For anyone connected to the organisation—employees, partners or customers—the listing raises practical questions about what may have left its systems and what steps are warranted while fuller information is still limited.

Inside the incident

According to the available record, Andalusia Group was listed by the alphv ransomware group on or about 29 September 2023. The reported summary characterises the event as a ransomware attack in which internal files were allegedly exfiltrated. No confirmed figure for the number of individuals affected has been published, and public detail does not include the precise date the intrusion began, the initial access method, the duration of unauthorised presence, or whether systems were encrypted in addition to data theft.

The listing itself constitutes a claim by the threat actor rather than an independently verified inventory of what was taken. No further technical indicators, ransom demands, or negotiated outcomes appear in the facts made public. In short, the incident is known principally through the group’s leak-site assertion and the accompanying description of exfiltrated internal files; scale, timing beyond the report date, and forensic particulars remain undisclosed.

Inside alphv

Alphv, also widely known in security reporting as BlackCat, has operated as a ransomware-as-a-service operation. Affiliates typically gain access to victim networks, move laterally, exfiltrate data, and deploy ransomware, after which the group or its partners threaten to publish stolen material if payment is not made. The model relies on dual pressure: operational disruption from encryption and reputational or regulatory harm from data exposure.

The group has been linked to numerous high-profile intrusions across sectors and geographies before and around 2023, often using customisable ransomware written in modern languages and maintaining a Tor-based leak site to name victims and, in some cases, release sample files. Public analysis has described tactics that include exploitation of exposed remote services, stolen credentials, and living-off-the-land techniques once inside a network. None of that general tradecraft confirms the specific path used against Andalusia Group; it only situates the claim within alphv’s established pattern of activity. Any assertion that alphv holds particular Andalusia Group files should be treated as the group’s unverified claim unless corroborated by the organisation or independent investigators.

About Andalusia Group

Andalusia Group is an organisation headquartered at Al Murjan Tower, King Abdullah Road, Hail Street, Floor 7, Jeddah, Mecca region, 21448, Saudi Arabia. A publicly listed contact number is +966 26529977. Beyond that address and contact information, the breach record supplies no detailed corporate profile. Organisations of this type operating in the Kingdom commonly manage commercial, administrative and personnel records as part of ordinary business.

A ransomware-related listing matters because entities in the region frequently hold data on employees, contractors, suppliers and clients, and because disruption or exposure can affect continuity of operations and trust. The absence of a fuller public description of Andalusia Group’s lines of business does not reduce the potential sensitivity of internal files; it simply means outside observers must rely on the limited facts while the organisation assesses impact.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. No itemised inventory—such as specific categories of personal data, financial records, medical information, or intellectual property—has been disclosed in the public report. The number of people whose information may appear in those files is unknown.

Organisations comparable in scale and setting typically maintain human-resources records, internal correspondence, contracts, financial and operational documents, and credentials or system-related data. Whether any of those categories were among the files alphv claims to hold has not been confirmed. Readers should therefore treat the contents as unconfirmed beyond the general description of “internal files.” Speculation about exact data types would exceed what has been reported.

Why it matters

For individuals, the principal risks of internal-file exposure include misuse of personal or contact details for phishing, social engineering, or identity-related fraud, especially if personnel or partner information was present. Even without a confirmed list of affected people, anyone who has worked with or for Andalusia Group may reasonably wish to heighten scrutiny of unexpected messages that reference the organisation or request sensitive actions.

For the organisation, a claimed exfiltration raises issues of operational continuity, possible regulatory notification duties under applicable Saudi and international rules, contractual obligations to partners, and reputational harm. Because the actor’s listing is a claim rather than a verified disclosure package, the concrete scope of those risks remains under assessment. Calm, factual communication and methodical investigation are more useful than assumptions about negligence or about the completeness of what the threat actor asserts.

Were you affected?

If you have a relationship with Andalusia Group—as an employee, former staff member, contractor, supplier or customer—consider practical steps while official details remain limited. Monitor financial and email accounts for unusual activity, treat unsolicited requests for credentials or payments with caution, and favour unique passwords with multi-factor authentication where available. If the organisation issues guidance or notification, follow those instructions promptly.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. Such checks do not confirm or deny involvement in this specific incident, but they can indicate whether your details have surfaced elsewhere and help you prioritise further protections.

AICompiled with AI assistance from public sources and published under our editorial standards.