kob.com Listed by ALP-001 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
kob.com has been listed by the ALP-001 ransomware group, which claims to have exfiltrated internal files; the incident was disclosed on 29 March 2026, though the exact date of the intrusion remains unknown. Individuals who may have had data held by kob.com should review any notices from the organization and take appropriate protective steps.
What happened
The reported incident consists of a listing posted by ALP-001 on March 29, 2026. The entry identifies kob.com, notes a claimed exfiltration of internal files, and references 1.127 TB of storage along with the organization’s reported revenue of $22 million. No further details on the method of access, encryption status, or ransom demands have been disclosed in the available information. The scale of any data exposure and the number of people affected are not stated.
The group behind it: ALP-001
ALP-001 is a ransomware operator that maintains a public leak site to list organizations it claims to have targeted. Such groups commonly combine encryption of systems with the removal of data, then use the threat of publication to encourage payment. Public records of the group’s prior activity show repeated use of this approach across multiple sectors. In this case, the listing itself constitutes the group’s claim regarding kob.com; no additional statements or evidence specific to this victim have been verified.
About kob.com
KOB 4, also known as Eyewitness News 4, operates as a television news station serving Albuquerque, Santa Fe, and other areas of New Mexico. Organizations of this type routinely collect and store internal documents, contact records, source materials, and operational data related to news production. A breach at a regional news outlet can expose both business information and material that relates to individuals who interact with the station.
The information in question
The listing refers to “internal files exfiltrated in ransomware attack.” No inventory of specific data categories has been released. Organizations in the broadcast news sector typically maintain employee records, vendor contracts, internal correspondence, and audience or advertising databases. The precise contents of the claimed exfiltration remain unconfirmed.
The real-world impact
Exposure of internal files can create operational challenges for the organization, including review of compromised systems and potential disruption to news production. For individuals whose information appears in those files, risks include misuse of contact details or other personal data. The absence of Reported Details on the number of people affected limits precise assessment of downstream consequences at this stage.
If your data was in this claimed breach
Monitor financial and email accounts for unusual activity and change passwords for any services associated with kob.com. Enable multi-factor authentication where available. Individuals can also run a free exposure scan of their email address against known breach data sets to determine whether their information has appeared in public listings.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
nepgroup.com Listed by ALP-001 Ransomware Groupiliad.fr Listed by ALP-001 Ransomware Grouppolsat.pl Listed by ALP-001 Ransomware Groupterix.com Listed by ALP-001 Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the kob.com Listed by ALP-001 Ransomware Group →
Publicly posted by alp-001 — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.