Dalumi Group Listed by alphv Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 04, 2023, the diamond company Dalumi Group was listed by the ransomware group alphv as a victim of an attack in which internal files were claimed to have been exfiltrated. Public reporting does not state how many people were affected, and the precise scope of the incident remains limited to what the group has asserted on its leak site.

For a business that handles high-value goods and maintains long-standing supply relationships, any confirmed or claimed compromise of internal material raises practical questions about operational continuity, partner trust, and the possible exposure of business records. What is known so far is narrow; what is not yet confirmed is substantial.

Inside the incident

According to the available record, Dalumi Group appeared on an alphv listing dated April 04, 2023. The description associated with that listing states that internal files were exfiltrated in a ransomware attack. No public figure has been given for the number of people affected. Timing details beyond the report date, the initial access method, the duration of any intrusion, and whether systems were encrypted or solely used for data theft have not been disclosed in the material provided.

Because the primary public signal is a threat-actor listing, the incident should be treated as a claimed event pending independent confirmation. No dollar amounts, file counts, or specific system names appear in the reported facts. Organisations facing such claims typically investigate quietly while assessing whether stolen data has been or will be published; those steps, if they occurred here, are not part of the public record summarised above.

The group behind it: alphv

alphv, also widely known in security reporting as BlackCat, is a ransomware operation that emerged in late 2021 and has been documented using a ransomware-as-a-service model. Affiliates gain access to victim networks, move laterally, exfiltrate data, and deploy encryption, after which the group pressures victims with the threat of leaking stolen material on a dedicated site. The group has been associated with double-extortion tactics and has targeted organisations across multiple sectors and countries.

Public technical reporting has described alphv tooling as relatively sophisticated for its time, including cross-platform capabilities and customisable payloads. Notable prior activity attributed to the group or its affiliates includes attacks on large enterprises and critical-infrastructure-adjacent firms, though each incident is separate. In the present case, the only claim tied specifically to Dalumi Group is the leak-site listing itself and the assertion that internal files were taken; no further statements by alphv about this victim are included in the facts.

Dalumi Group and its sector

Dalumi Group operates in the diamond trade. Public descriptions of the company emphasise its role since 1993 as a Sightholder of De Beers, giving it access to rough diamonds from a leading producer, and stress themes of source, heritage, and family integrity in its branding. Companies of this type sit at the intersection of high-value physical inventory, international supply chains, and specialised wholesale and retail relationships.

A breach affecting such an organisation is consequential because diamond businesses typically maintain detailed records of suppliers, clients, grading and provenance data, financial arrangements, and internal commercial strategy. Disruption or leakage can affect not only the firm but also counterparties who rely on confidentiality and continuity. The sector’s reliance on trust and documented origin makes any credible claim of internal-file theft noteworthy even when full technical details remain unpublished.

What data was at risk

The facts name the exposed material only as “internal files exfiltrated in a ransomware attack.” No inventory of file types, databases, or record categories has been published in the material at hand. Exact contents are therefore unconfirmed.

Organisations in the diamond and luxury-goods supply chain commonly hold customer and partner contact details, transaction and shipping records, employee information, contracts, pricing and inventory data, and internal correspondence. Whether any of those categories were among the files alphv claims to have taken cannot be established from the public summary. Readers should treat specific data-type assertions beyond “internal files” as unverified unless corroborated by the company or independent investigators.

The real-world impact

For individuals whose information may have been stored in corporate systems—employees, clients, or suppliers—the practical risks include unwanted contact, social-engineering attempts that reference real business relationships, and, in rarer cases, fraud that exploits knowledge of transactions or personal details. Because the number of people affected is unknown and the precise data types are undisclosed, the scale of personal exposure cannot be quantified from current public facts.

For Dalumi Group, consequences can include investigative and recovery costs, possible operational disruption, scrutiny from partners and regulators, and reputational pressure if material is released. Ransomware claims often aim to create leverage through the threat of publication; whether data was ultimately posted, sold, or withheld is not stated in the available record. Counterparties may reasonably review their own exposure if they shared sensitive documents with the firm.

If your data was in this claimed breach

If you have a past or present relationship with Dalumi Group and are concerned your information could have been involved, consider the following practical steps:

• Monitor financial and email accounts for unexpected activity or targeted phishing that references diamonds, jewellery, or business dealings.
• Treat unsolicited messages asking for payments, credentials, or urgent action with heightened caution, even if they appear to know legitimate details.
• Update passwords on related accounts and enable multi-factor authentication where available.
• Request clarification from the company through official channels if you are an employee, client, or partner seeking confirmation of impact.
• Run a free exposure scan of your email address to check whether it has already appeared in known breach datasets elsewhere.

Public detail on this incident remains limited to the April 04, 2023 listing and the claim of internal-file exfiltration. Further clarity, if it emerges, would come from the organisation or from verified secondary reporting rather than from the threat actor’s assertions alone.

AICompiled with AI assistance from public sources and published under our editorial standards.