Markas Listed by alphv Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 21 February 2023, the facility-services company Markas was listed by the ransomware group alphv as a victim of an attack in which internal files were claimed to have been exfiltrated. The number of people affected remains unknown, and public detail beyond the listing and the description of internal files is limited.

For an organisation that has supplied tailored facility services since 1985, any confirmed exposure of internal material raises practical questions for staff, clients and partners about what may have left the network and how it could be misused. What is established so far is the claim on the group’s leak site and the reported nature of the data; further verification has not been made public.

What happened

According to the available record, Markas was listed by alphv on or around 21 February 2023. The report states that internal files were exfiltrated in a ransomware attack. No public figure has been given for the volume of data, the number of systems involved, or the precise date the intrusion began. The method of initial access, any ransom demand, and whether encryption was also deployed have not been disclosed in the material provided. The listing itself constitutes the group’s claim that it held and removed internal files; independent confirmation of the full scope is not part of the public record summarised here.

The group behind it: alphv

alphv, also widely known in public reporting as BlackCat, is a ransomware operation that emerged in late 2021 and has operated on a ransomware-as-a-service model. Affiliates typically gain access to target networks, move laterally, exfiltrate data, and then deploy encryption while threatening to publish stolen material if payment is not made. The group has been associated with attacks across multiple sectors and geographies, often using double-extortion tactics that combine encryption with leak-site pressure. Public technical reporting has described custom ransomware written in Rust, flexible configuration options for affiliates, and negotiation channels hosted on dark-web infrastructure.

In this case, alphv’s leak-site listing of Markas is treated as an unverified claim. No additional statements attributed to the group about this specific victim—beyond the assertion that internal files were taken—appear in the facts at hand. Past alphv activity supplies context for how such groups generally operate; it does not by itself prove the details of any single incident.

About Markas

Markas has operated since 1985 in the facility-services sector. Public descriptions of the company note that its founder, Mario Kasslatter, built a range of services intended to give each customer tailored facility support. Organisations of this type commonly manage cleaning, maintenance, catering, security coordination, and related on-site operations for commercial, healthcare, education or public-sector clients. They typically hold contracts, site plans, employee records, supplier details, and operational schedules—information that is operationally sensitive even when it is not classified as highly regulated personal data.

A breach affecting such a provider matters because facility-services firms sit inside the daily workings of many other organisations. Disruption or exposure can affect not only the company’s own workforce but also the clients whose premises and routines depend on those services. The consequential risk is therefore both internal and third-party.

The information in question

The facts name the exposed material only as internal files exfiltrated in a ransomware attack. No inventory of file types, no count of records, and no confirmation of whether customer, employee or financial data were included have been published in the material relied on here. Exact contents therefore remain unconfirmed.

Companies in facility services ordinarily hold, among other things:

• Employee and contractor personal and payroll-related information
• Client contracts, site access details and service schedules
• Supplier and subcontractor records
• Internal operational, financial and administrative documents

Any of those categories could in principle appear among “internal files,” but that possibility is not the same as confirmed exposure. Until a fuller disclosure or official notification is issued, affected parties should treat the precise data set as unknown.

What's at stake

For individuals whose information may have been among the files, the practical risks include unwanted contact, phishing that references real internal details, and—if identity or financial data were present—attempts at fraud. Because the exact contents are unconfirmed, these remain potential rather than proven harms for any given person.

For Markas, the stakes include operational disruption, contractual and regulatory follow-up with clients, and the cost of investigation and remediation. Clients may need assurance that their own site information or shared credentials were not compromised. Reputation and trust in a service business that depends on access to third-party premises can be affected even when the full technical picture is still incomplete. None of these outcomes requires assuming negligence; they follow from the ordinary consequences of a claimed data exfiltration in this sector.

If your data was in this claimed breach

If you are a current or former employee, contractor or client contact of Markas, treat the incident as a prompt to review your own exposure rather than as proof that your specific records were taken. Practical first steps include watching for unexpected messages that reference the company or its services, enabling multi-factor authentication on important accounts, and updating passwords that may have been reused. If you receive a formal notification from the organisation, follow the instructions it provides. You can also run a free exposure scan of your email address to check whether your information has already appeared in known breach data sets, which offers a concrete way to see whether your details are circulating from this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.