lacor.es Listed by ALP-001 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

A ransomware group known as ALP-001 has listed lacor.es on its leak site, claiming to have carried out an attack that resulted in the exfiltration of internal files. The listing appeared on 29 March 2026 and sets a deadline of 8 April 2026. No confirmed figure for the number of individuals affected has been released, and the organisation has not publicly confirmed the claim. The incident is one of many similar claims made by ransomware operators that maintain public leak sites to pressure victims. The scale of any encryption or the precise method of initial access remain undisclosed in available reporting.

What happened

ALP-001 posted lacor.es on its leak site on 29 March 2026. The entry states that internal files were exfiltrated during a ransomware attack and lists the data volume as 182.71 GB. The post describes the target as a small organisation whose files the group found of interest. No independent confirmation of the data’s authenticity or volume has been published.

The number of people whose information may be involved is not stated. The group set an 8 April 2026 deadline in the listing. Details on whether files have been published or whether any ransom demand was met are not available from the public listing.

Who is ALP-001?

ALP-001 is a ransomware operator that maintains a leak site to publish data it claims to have stolen from targeted organisations. Such groups typically gain access through phishing, stolen credentials or unpatched systems, then exfiltrate files before deploying encryption. The group’s public posts often include commentary on the victim and set deadlines for publication if demands are not met.

The listing for lacor.es constitutes a claim by the group. No separate verification from law-enforcement sources or the organisation itself has been reported in connection with this entry.

About lacor.es

lacor.es is a Spanish organisation reporting approximately nine million dollars in annual revenue. Entities of this size commonly maintain records relating to customers, employees, suppliers and internal operations. A breach involving internal files can expose business processes and personal data held in the ordinary course of such operations.

Because the organisation operates in Spain, any confirmed personal data would fall under the GDPR, which requires notification to regulators and affected individuals when a breach is likely to result in a risk to rights and freedoms.

The information in question

The listing states that internal files were exfiltrated. No further breakdown of file types or specific data categories has been provided by the group or confirmed by the organisation. Organisations of this profile routinely store employee records, customer contact details, financial documents and operational correspondence; however, the exact contents of the 182.71 GB remain unconfirmed.

The real-world impact

Exposure of internal files can reveal personal information about employees or customers, potentially enabling identity-related fraud or targeted phishing. For the organisation, the incident may lead to regulatory scrutiny under Spanish and EU data-protection rules and may require forensic investigation and remediation costs.

Without a confirmed list of affected individuals, the full extent of personal risk cannot be quantified from public sources.

If your data was in this claimed breach

Monitor official statements from lacor.es and any notifications issued under GDPR obligations. Enable multi-factor authentication on accounts that may share credentials with the organisation and review bank and credit statements for unusual activity. Individuals can also run a free exposure scan of their email address against known breach data to check for prior appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.