Globacom Limited Listed by alphv Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target large telecommunications providers, treating network access and internal archives as leverage in public extortion campaigns. Listings on criminal leak sites have become a routine pressure tactic, often appearing before any independent confirmation of what was taken or how far an intrusion went.

On 26 July 2023, Globacom Limited, the Nigerian telecommunications operator commonly known as Glo, was listed by the alphv ransomware group. The group claimed it had breached the company’s network, exfiltrated more than 600 GB of internal files, and threatened to release the material unless senior management made contact within three days. The number of people affected remains unknown, and public detail beyond the group’s own statements is limited.

What happened

According to the listing attributed to alphv, Globacom Limited’s network was compromised in a ransomware attack and internal files were removed. The group stated that more than 600 GB of data had been taken and that it was offering the top management of “Gloworld” and Mike Adenuga a three-day window to negotiate. It warned that refusal would result in the data being published for free download. The listing named categories of material it claimed to hold, including payments, company financial data, and financial data of employees; the published text appears truncated after the word “signe.” No independent confirmation of the intrusion method, the exact date of access, or the full contents of the archive has been made public. The number of individuals whose information may be involved is undisclosed.

The group behind it: alphv

alphv, also widely known as BlackCat, is a ransomware operation that has been active since late 2021. It has operated on a ransomware-as-a-service model, recruiting affiliates who conduct intrusions and share proceeds with the core developers. The group is known for using custom ransomware written in Rust, double-extortion tactics that combine encryption with data theft, and public leak sites on which it names victims and posts samples or full archives when ransoms are not paid. alphv has previously claimed attacks against organisations across multiple sectors and geographies. In this case, the appearance of Globacom Limited on its leak site constitutes the group’s claim; it should be treated as an unverified assertion unless corroborated by the victim or by independent investigators.

Who is Globacom Limited?

Globacom Limited, trading as Glo, is a major Nigerian multinational telecommunications company. Public reporting places its annual revenue in the region of $1.3 billion. Like other large mobile and broadband operators, it manages extensive customer bases, billing systems, corporate networks, and internal administrative records. A breach affecting such an organisation is consequential because telecom providers sit at the centre of everyday communications and hold both operational data and information linked to employees and business partners. Any confirmed exposure of internal financial or payment records can affect not only the company but also individuals whose details appear in those systems.

What was likely exposed

The facts available name the exposed material only in general terms: internal files exfiltrated in a ransomware attack. The alphv listing specifically claimed that the archive contained payments, financial data of the company, and financial data of employees, with the published description cutting off mid-phrase. Exact file inventories, record counts, and the full scope of personal or corporate identifiers have not been independently confirmed. Organisations of this type typically hold employee payroll and HR records, vendor and payment information, internal financial statements, and operational documents. Whether any of those categories were present in the volume claimed by the group remains unconfirmed outside the threat actor’s own statements.

The real-world impact

If the claimed financial and payment data are authentic, employees and contractors could face risks of fraud, targeted phishing, or misuse of payroll and banking details. The organisation itself may confront operational disruption, regulatory scrutiny, and the cost of investigating and containing the incident. Because the number of people affected is unknown and the precise contents unverified, the scale of individual harm cannot yet be measured. Even when full archives are not released, the mere listing can prompt secondary scams in which criminals impersonate the company or the attackers. For a telecommunications provider, any confirmed compromise also raises longer-term questions about the security of systems that support customer service and internal administration.

If your data was in this claimed breach

If you are a current or former employee, contractor, or partner of Globacom Limited, treat unsolicited messages that reference this incident with caution. Monitor financial accounts and credit activity for unusual transactions, and be alert to phishing that uses company or payment themes. Change passwords on work-related and personal accounts that may have shared credentials, and enable multi-factor authentication where it is available. Because public confirmation of specific personal records is lacking, assume only that internal financial material was claimed, not that every individual’s data has been proven exposed. Readers can run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets, and can then decide on further monitoring or credit freezes according to their own circumstances.

AICompiled with AI assistance from public sources and published under our editorial standards.