Cosal is a company that distributes personal and confidential data of its customers and re Listed by alphv Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations by stealing internal data and threatening public release, a pattern that has become a routine feature of the current cyber-threat landscape. Listings on criminal leak sites often surface before independent confirmation, leaving customers and partners to weigh incomplete information.

On 21 September 2023, the group known as alphv listed Cosal, a financial-services firm based in Luanda, Angola, claiming to have exfiltrated internal files in a ransomware attack. The number of people affected remains unknown, and public detail beyond the listing itself is limited. For anyone who has dealt with Cosal, the claim raises practical questions about what may have been taken and what steps are worth taking now.

What happened

According to the available record, Cosal was listed by the alphv ransomware group on or about 21 September 2023. The group’s claim states that internal files were exfiltrated in a ransomware attack and that the company distributes personal and confidential data of its customers. No confirmed figure for the number of individuals affected has been published, and the precise method of initial access, the duration of any intrusion, and the full scope of systems involved have not been disclosed in the public summary.

The listing itself constitutes an unverified claim by the threat actor. Independent confirmation of the breach’s technical details, or of any subsequent data publication, is not contained in the facts at hand. What is known is limited to the reported date, the named organisation, the sector, and the assertion that internal files were taken.

Who is alphv?

Alphv, also widely tracked in public reporting as BlackCat, is a ransomware operation that has been active for several years. The group typically operates a ransomware-as-a-service model, in which affiliates conduct intrusions and the core operators manage negotiation portals and data-leak sites. Its usual playbook involves gaining access to a network, moving laterally, exfiltrating data, and then encrypting systems while threatening to publish the stolen material if a ransom is not paid.

Alphv has been associated with attacks across multiple sectors and geographies. Public technical analyses have described the group’s use of custom ransomware written in Rust, double-extortion tactics, and leak sites that name victims and sometimes sample allegedly stolen files. None of that general background states the specific claims made about Cosal; it only situates the actor whose name appears on the listing. Any assertion that alphv holds Cosal data remains the group’s claim unless corroborated by the victim or by independent evidence.

About Cosal

Cosal is described as a company operating in the financial-services industry. Its headquarters are listed at nº 76 / 7 Rua Rainha Ginga, Luanda, Luanda, P.O. BOX 2433, Angola, with a phone number of +244 933333337. Organisations in this sector commonly handle customer account information, transaction records, identification documents, and internal operational files. Because financial-services firms sit at the intersection of personal data and monetary flows, a breach claim against such an entity is consequential even when the exact contents of any theft remain unconfirmed.

Public detail beyond the address, sector, and the alphv listing is sparse. The firm’s precise size, customer base, and the nature of the services it provides to individuals or businesses are not elaborated in the available record. What matters for those who may have a relationship with Cosal is that financial-services data, if exposed, can be reused for fraud, impersonation, or further targeting.

What was likely exposed

The facts name the exposed material only as “internal files exfiltrated in a ransomware attack.” No inventory of file types, no record counts, and no confirmation of customer versus purely corporate data have been supplied. Exact contents are therefore unconfirmed.

Organisations of this kind typically hold categories of information that, if taken, would raise concern. In concrete terms, the following are the sorts of material often present in financial-services environments, though none can be asserted as factually present in this incident:

• Customer identification and contact details
• Account or transaction-related records
• Internal corporate documents, contracts, and correspondence
• Credentials or configuration data used inside the organisation

Until Cosal or a competent authority publishes a verified description, any list of specific data elements remains speculative. The only firmly reported element is the claim of internal-file exfiltration.

What's at stake

For individuals who have done business with Cosal, the primary risks are secondary misuse of personal or financial information—account takeover attempts, targeted phishing that references real relationships, or identity fraud. Because the number of people affected is unknown and the data types are not itemised, it is impossible to gauge how widely those risks extend. People should treat unsolicited contact that cites Cosal or Angolan financial dealings with heightened caution.

For the organisation, a public ransomware listing can damage trust, trigger regulatory scrutiny in jurisdictions that oversee financial data, and impose recovery and notification costs. Even when encryption or operational disruption is not confirmed, the mere assertion that internal files left the network creates lasting uncertainty for customers, partners, and employees. None of these consequences prove negligence; they simply describe the ordinary fallout of a claimed double-extortion incident.

Were you affected?

If you have been a customer, employee, or partner of Cosal, practical first steps are straightforward. Monitor financial accounts and credit activity for unfamiliar transactions. Treat emails, calls, or messages that reference the company or request urgent action as potentially fraudulent until verified through a known official channel. Change passwords on any accounts that may have shared credentials or recovery information with Cosal-related services, and enable multi-factor authentication where it is available. Keep records of any suspicious contact.

Public detail on this incident remains limited; the alphv listing is a claim, the scale is undisclosed, and no official victim notification text is included in the facts. Readers who want an additional check can run a free exposure scan of their email address to see whether their information has already surfaced in known breach data sets. That step does not confirm or deny involvement in this specific event, but it can indicate whether the same address appears in other documented exposures and help prioritise further monitoring.

AICompiled with AI assistance from public sources and published under our editorial standards.