i-Can Advisory Group inc Listed by alphv Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional-services firms that hold concentrated stores of personal and legal data, listing victims on leak sites to pressure payment and amplify harm. In that landscape, the appearance of a smaller advisory practice on a major ransomware group’s site is a familiar pattern: limited public detail, claimed exfiltration, and uncertainty for anyone who may have shared documents with the firm.

On 9 October 2023, i-Can Advisory Group inc was listed by the alphv ransomware group. Public reporting describes the matter as a ransomware attack in which internal files were said to have been exfiltrated. The number of people affected has not been disclosed, and independent confirmation of the full scope remains limited. For clients and contacts of an immigration advisory practice, even an unverified claim matters because the firm’s work routinely involves sensitive personal and legal information.

What happened

According to available public information, i-Can Advisory Group inc was listed by the alphv ransomware group on or about 9 October 2023. The reported summary characterises the organisation as providing immigration advisory services from experienced lawyers. The facts state that internal files were exfiltrated in a ransomware attack. No public figure has been given for the number of people affected, and details such as the initial access method, the duration of any intrusion, whether systems were encrypted, or any ransom demand are not disclosed in the material at hand. The listing itself should be treated as a claim by the group rather than as independently verified proof of every asserted detail.

Inside alphv

Alphv, widely known in public reporting as BlackCat, is a ransomware operation that has been active in recent years using a ransomware-as-a-service model. Affiliates typically gain access to victim networks, move laterally, exfiltrate data, and deploy encryption, then threaten to publish stolen material on a dedicated leak site if payment is not made. The group has been associated with attacks across multiple sectors, including professional services, and has used double-extortion tactics—combining operational disruption with the threat of data exposure—as a core pressure mechanism. Public technical reporting has described custom ransomware written in modern languages and flexible negotiation and leak-site infrastructure. None of that general background states the specific technical path or full contents of any files allegedly taken from i-Can Advisory Group inc; it only situates the actor whose name appears on the listing.

About i-Can Advisory Group inc

i-Can Advisory Group inc is described in the reported summary as offering immigration advisory services from experienced lawyers. Organisations of this type typically assist individuals and families with visas, permanent residence, citizenship pathways, and related legal filings. In the ordinary course of that work they collect identity documents, immigration histories, correspondence with government agencies, financial supporting material, and other personal data needed to prepare applications. A breach or claimed exfiltration at such a firm is consequential because the data is often highly identifying, difficult to change, and useful for fraud, impersonation, or further social engineering against clients and their families. Public detail on the firm’s size, locations, or exact client base in connection with this incident is limited.

What was likely exposed

The facts name the exposed material as internal files exfiltrated in a ransomware attack. No inventory of file types, no count of records, and no confirmation of specific data elements have been provided in the available material. The exact contents therefore remain unconfirmed. Organisations that provide immigration advisory services commonly hold categories of information such as the following, though it is not established that any particular category was taken in this case:

• Identity and biographic details used in immigration filings
• Copies of passports, visas, and supporting civil documents
• Case correspondence, forms, and notes related to applications
• Contact information and, in some matters, financial or employment evidence

Readers should treat any assumption about precise data types as speculative until the organisation or a competent authority publishes a verified notice.

The real-world impact

For individuals who have used or corresponded with an immigration advisory practice, the main risks are practical rather than abstract. Exposed identity and case materials can be misused for targeted phishing, account takeover attempts, or fraudulent applications in someone else’s name. Immigration files often contain stable identifiers and life-history details that cannot be “reset” like a password, so monitoring and caution may need to continue for an extended period. For the organisation, a ransomware incident and leak-site listing can mean operational disruption, legal and regulatory notification duties where they apply, reputational harm, and the cost of investigation and remediation. Because the number of people affected is unknown and the full data set is undisclosed, the scale of individual harm cannot be stated as fact; the prudent stance is to assume that anyone who supplied documents or personal information to the firm could be in scope until told otherwise.

Were you affected?

If you are a current or former client, or if you shared identity or case documents with i-Can Advisory Group inc, treat the listing as a reason to take basic protective steps while awaiting any official notice from the firm. Watch for unexpected emails or calls that reference your immigration matter or request further documents or payments. Consider placing fraud alerts or credit freezes where that is available in your country, and review financial and government accounts for unfamiliar activity. Preserve any breach notification you receive and follow instructions from the organisation or regulators rather than from unsolicited third parties. You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets, which can help you prioritise password changes and monitoring on the accounts that matter most.

AICompiled with AI assistance from public sources and published under our editorial standards.