It Works Global Listed by alphv Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations by pairing encryption with data theft and public leak-site postings, turning confidential files into leverage. In that landscape, the appearance of a company name on a criminal forum is often the first public signal that an intrusion has occurred and that stolen material may be used for extortion or further crime.

On 19 May 2023 It Works Global was listed on the alphv ransomware leak site. The group claims to have stolen internal data in a ransomware attack. The number of people affected remains unknown, and public detail beyond the listing itself is limited. The incident matters because any organisation that holds customer, distributor or employee records can become a vector for fraud and privacy harm once internal files leave its control.

Inside the incident

Public reporting states that It Works Global appeared on the alphv leak site on 19 May 2023. According to the listing, the group claims to have exfiltrated internal files during a ransomware attack. No confirmed figure for the volume of data, no technical description of the initial access method, and no independent verification of the stolen material have been released in the available record. The number of individuals whose information may be involved is listed as unknown. Beyond the group’s claim that internal files were taken, further operational detail is undisclosed.

Inside alphv

Alphv, also widely known as BlackCat, is a ransomware operation that has functioned as a ransomware-as-a-service platform. Affiliates gain access to victim networks, deploy the encryptor, and exfiltrate data before encryption; the core group then hosts negotiation and leak infrastructure. The model typically involves double extortion: victims face both operational disruption from locked systems and the threat of public release of stolen files if a ransom is not paid. Alphv has been linked to numerous high-profile intrusions across multiple sectors since its emergence, often publishing sample data or full archives on its leak site when negotiations stall. In this case the group’s listing of It Works Global constitutes an unverified claim that internal data was stolen; no additional statements specific to this victim beyond that claim appear in the public facts.

It Works Global and its sector

It Works Global is a multi-level marketing company that sells health, wellness and beauty products through a network of independent distributors. Organisations of this type ordinarily maintain records on customers, distributors, payment details, order histories, and internal corporate documents such as contracts, financial spreadsheets and employee information. A breach affecting such an entity is consequential because the data sets often combine personal identifiers with commercial and financial information, creating opportunities for targeted fraud against both the company and the individuals connected to it. Disruption of internal systems can also interrupt order fulfilment, commission payments and customer support, amplifying the operational cost of an attack.

What was likely exposed

The facts state only that internal files were exfiltrated in a ransomware attack; the precise contents have not been disclosed or independently confirmed. Organisations in this sector commonly hold the kinds of material listed below, yet it remains unconfirmed whether any or all of these categories were among the files the group claims to have taken:

• Customer and distributor contact details and account records
• Order, payment and commission-related documents
• Internal corporate files, contracts or financial spreadsheets
• Employee or contractor information

Because the exact inventory is unconfirmed, no specific data type should be treated as verified fact.

The real-world impact

For individuals whose information may have been present in internal files, the principal risks are phishing, social-engineering attempts and potential identity misuse if personal or financial details were included. Attackers frequently reuse stolen contact lists and internal correspondence to craft convincing messages that reference real orders, commissions or company processes. For the organisation, consequences can include prolonged operational disruption, reputational damage, regulatory scrutiny where personal data is involved, and the cost of investigation and remediation. Until the full scope of the exfiltrated material is known, both the company and any affected parties must treat the exposure as a credible but incompletely documented threat.

What to do if you're exposed

If you have done business with It Works Global or worked with the company, treat any unexpected messages that reference orders, payments or internal matters with caution. Change passwords on related accounts, enable multi-factor authentication where available, and monitor financial statements for unfamiliar activity. Consider placing a fraud alert with credit bureaus if you believe sensitive personal data may have been involved. Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. Remain alert for follow-on scams that exploit the publicity of the incident, and rely on official company channels rather than unsolicited links or attachments.

AICompiled with AI assistance from public sources and published under our editorial standards.