Banco Sol Listed by alphv Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Banco Sol, a private bank based in Angola, was listed by the alphv ransomware group as of a report dated June 03, 2025. Public detail indicates that internal files were exfiltrated in a ransomware attack, though the number of people affected remains unknown and further specifics about the incident have not been disclosed.

The listing itself is a claim by the group. For customers, staff and partners of a bank serving hundreds of thousands of clients, any confirmed exposure of internal material carries practical consequences that warrant careful attention rather than speculation.

Inside the incident

According to the available record, Banco Sol was named on alphv’s leak site in connection with a ransomware attack in which internal files were said to have been taken. The report date is June 03, 2025. No public confirmation has been issued regarding the precise timing of the intrusion, the technical method used, the volume of data involved, or whether systems were encrypted as well as data removed. The number of individuals potentially affected is listed as unknown.

Because the only concrete assertion is the group’s claim of exfiltration of internal files, the full scope of the incident remains unconfirmed. Organisations facing such claims typically investigate independently; until those findings are released, the public record is limited to the listing and the description of internal files having been taken.

The group behind it: alphv

alphv, also widely known in public reporting as BlackCat, is a ransomware operation that has functioned as a ransomware-as-a-service model. It has been documented for using double-extortion tactics: encrypting systems while also stealing data and threatening to publish it if payment is not made. The group has previously claimed responsibility for attacks across multiple sectors and geographies, often posting victim names and sample data on dedicated leak sites to increase pressure.

In this case the group claims Banco Sol as a victim and asserts that internal files were exfiltrated. That claim has not been independently verified in the material provided. alphv’s public profile includes the use of sophisticated encryption, affiliate recruitment, and opportunistic targeting of organisations that hold valuable operational or customer information. None of those general patterns should be read as Reported Details of the Banco Sol event beyond the leak-site listing itself.

About Banco Sol

Banco Sol is a private Angolan bank founded 17 years ago and headquartered in Luanda, the capital. It is recognised as one of Africa’s more successful financial institutions, with 940,000 clients on its books, a staff of 1,642 and 180 branches across the country. As a retail and commercial bank it sits at the centre of everyday financial activity for a large customer base in Angola.

Banks of this type routinely process and store account details, transaction records, identity documents, credit information and internal operational files. A ransomware incident affecting such an institution therefore raises questions not only for the organisation’s continuity but also for the privacy and financial security of the people who rely on its services.

What data was at risk

The facts state that internal files were exfiltrated in the ransomware attack. No further breakdown of file types, customer records, employee data or financial documents has been publicly named. Exact contents therefore remain unconfirmed.

Organisations in the banking sector typically hold customer identification and contact data, account and transaction histories, loan and credit files, employee records and proprietary operational documents. Whether any of those categories were among the internal files claimed by alphv is not established in the available record. Readers should treat any specific assertion about the precise data set as unverified until official confirmation appears.

Why it matters

For individuals, the principal risks associated with a bank-related data claim include potential misuse of personal or financial information, phishing or social-engineering attempts that reference the bank, and the longer-term possibility of identity or account fraud if sensitive records were involved. Because the number of people affected is unknown and the exact data types are not detailed, the scale of those risks cannot yet be quantified.

For Banco Sol the consequences include operational disruption, regulatory scrutiny common to financial institutions, reputational pressure and the cost of investigation and remediation. Even when a listing is only a claim, the mere association with a ransomware group can affect customer confidence. Clear, timely communication from the bank remains the most reliable source of guidance for those who bank with it.

Were you affected?

If you are a customer, employee or partner of Banco Sol, consider the following practical steps while waiting for any official confirmation:

• Monitor account statements and transaction alerts for unusual activity and report anything unexpected to the bank through official channels only.
• Be cautious of unsolicited emails, calls or messages that claim to relate to a Banco Sol security incident; verify any request independently.
• Change passwords for online banking and related email accounts, and enable multi-factor authentication where available.
• Review credit reports or equivalent local financial monitoring services if you have reason to believe identity data may have been involved.
• Keep records of any correspondence you receive from the bank about the matter.

Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. That check does not confirm or rule out involvement in this specific incident, but it can highlight other exposures that warrant attention.

AICompiled with AI assistance from public sources and published under our editorial standards.