inatech.com Listed by ALP-001 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
inatech.com was listed by the ALP-001 ransomware group on 08 April 2026, after internal files were exfiltrated in a ransomware attack; the date of the intrusion itself has not been established. An undisclosed number of people may be affected, and anyone who has shared data with the company should check for alerts or contact inatech.com directly.
On 8 April 2026 the ransomware group ALP-001 listed inatech.com on its leak site, claiming to have exfiltrated internal files during a ransomware attack. The listing states that 51 GB of data were taken and that 61 sample files are available for download from the group’s page. No figure for the number of individuals affected has been published, and the organisation has not issued a public statement confirming or denying the incident.
What happened
The listing appeared on 8 April 2026. It identifies inatech.com as the target, notes a United Kingdom base and $31.6 million in revenue, and states that internal files were removed. The group reports having uploaded 61 files as samples and sets a deadline of 17:30:58 on 18 April 2026. No further technical details about the intrusion method, the total volume of data removed, or any encryption of systems have been released by either the group or the company.
Who is ALP-001?
ALP-001 is a ransomware operation that maintains a public leak site where it lists organisations it claims to have compromised. Like other groups of this type, it typically publishes sample files and sets payment deadlines to pressure victims. The current entry for inatech.com constitutes the group’s claim; independent confirmation of the data’s origin or volume has not been provided.
Who is inatech.com?
Inatech.com supplies cloud-based Energy Trading and Risk Management (ETRM) and fuel-management software to the energy sector. The firm automates trading, risk and operational processes for organisations that handle energy commodities. Its customer base therefore includes entities that rely on accurate, timely data for market participation and regulatory compliance.
What was likely exposed
The listing refers only to “internal files exfiltrated in ransomware attack.” The exact categories of information contained in the 51 GB have not been disclosed. Organisations in this sector commonly hold customer contract details, trading records, operational logs and authentication material; however, the precise contents of the exfiltrated material remain unconfirmed.
Why it matters
Energy-sector software often processes commercially sensitive transaction and pricing data. Exposure of such material can affect market positions, contractual obligations and regulatory reporting for both the vendor and its clients. Where authentication credentials are involved, the risk extends to further unauthorised access to connected systems. The absence of a confirmed count of affected individuals leaves the scope of personal-data exposure unclear.
What to do if you're exposed
Monitor official statements from inatech.com for any guidance on the incident. Review account activity on any platforms that integrate with ETRM or fuel-management services and change passwords if unusual access is detected. Enable multi-factor authentication where available. Individuals can run a free exposure scan of their email address against known breach data to check whether their information appears in published records.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
aviwest.com Listed by ALP-001 Ransomware Groupartmotion.net Listed by ALP-001 Ransomware Groupasseco-ce.com Listed by ALP-001 Ransomware Groupknewin.com Listed by ALP-001 Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the inatech.com Listed by ALP-001 Ransomware Group →
Publicly posted by alp-001 — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.