jaxa.jp Listed by ALP-001 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 26, 2026, the domain jaxa.jp appeared on a listing associated with the ALP-001 ransomware group. The entry described the organization as Japanese, with reported revenue of $367 million and 6.9 TB of storage marked as ready for release. The group stated that internal files had been exfiltrated during a ransomware operation, though no independent confirmation of the data volume or contents has been made public. The number of individuals affected remains unknown. The listing carried a deadline of April 5, 2026. No further details on the intrusion method, duration of access, or whether encryption was deployed have been disclosed.

Breaking down the breach

The incident record shows only that jaxa.jp was added to ALP-001’s listing on the reported date. The entry notes the exfiltration of internal files but provides no file counts, sample contents, or technical indicators. Scale indicators such as the 6.9 TB figure appear in the listing itself; whether this represents data already removed or an estimate of accessible storage is not clarified. No statements from the organization confirming or disputing the claims have been referenced in the available record.

Inside ALP-001

ALP-001 is a ransomware operator that maintains a public listing of claimed victims. Groups of this type commonly gain initial access through phishing, credential compromise, or exploitation of remote services, then move laterally to locate and copy data before deploying encryption. The listing of a target functions as the group’s primary public claim of involvement; verification of the underlying intrusion typically requires statements from the affected organization or forensic findings that have not been released here.

jaxa.jp and its sector

jaxa.jp belongs to Japan’s national space agency, which conducts satellite operations, launch services, and collaborative research with international partners. Organizations in this sector routinely hold technical specifications, mission data, contractor information, and administrative records. A successful intrusion can therefore touch both operational systems and sensitive project documentation whose exposure carries implications beyond the immediate victim.

What was likely exposed

The listing states that internal files were exfiltrated. No inventory of specific file types or data categories has been published. Organizations of this kind typically maintain engineering documents, personnel records, financial information, and research datasets; however, the precise contents removed in this case remain unconfirmed.

What's at stake

Exposure of internal files can reveal operational details that affect ongoing projects and partnerships. For individuals whose information appears in administrative or contractor records, the primary risks involve follow-on phishing or account misuse. For the organization, the incident adds to the body of publicly discussed intrusions against research and government-linked entities, regardless of whether the listed data is ultimately published.

What to do if you're exposed

Individuals can monitor official statements from jaxa.jp for any guidance on affected records. Basic steps include changing passwords for any accounts linked to the organization, enabling multi-factor authentication, and reviewing recent login activity. Readers may also run a free exposure scan of their email address against known breach datasets to determine whether their information has appeared in previously published collections.

AICompiled with AI assistance from public sources and published under our editorial standards.