Notos Com Listed by alphv Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 7 October 2022, the organisation Notos Com appeared on a leak site operated by the ransomware group alphv. Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and further technical detail about timing, intrusion method, and the precise contents of the taken material has not been disclosed in the available record.

A listing of this kind is a claim by the threat actor rather than an independently verified confirmation. Even so, the appearance of a major Greek retail and wholesale group on such a site raises clear questions for employees, partners, and customers about what internal material may have left the organisation’s control and what practical steps those people should consider.

What happened

According to the public record, Notos Com was listed by the alphv ransomware group on or around 7 October 2022. The reporting characterises the incident as a ransomware attack in which internal files were allegedly exfiltrated. No figure for the volume of data, no list of specific file names or systems, and no confirmed count of affected individuals have been published in the facts available. The method of initial access, the duration of any dwell time inside the network, and whether encryption was also deployed alongside theft are likewise undisclosed.

Because the primary public signal is the group’s own leak-site listing, the incident should be treated as an asserted claim pending any fuller confirmation from the organisation or independent investigators. What is established is limited: the victim name, the attributed actor, the reported date, and the description that internal files were taken during a ransomware event.

Inside alphv

Alphv, widely known in security reporting as BlackCat, is a ransomware operation that has functioned as a ransomware-as-a-service offering. Affiliates gain access to victim environments, exfiltrate data, and deploy encryption, after which the core group typically handles negotiations and leak-site publication. The model relies on double extortion: victims face both operational disruption from encryption and the threat that stolen data will be published if a ransom is not paid.

The group has been associated with attacks across multiple sectors and geographies. Its leak sites have been used to name organisations and, in some cases, to release samples or larger archives of stolen material. Public technical reporting has described custom ransomware written in Rust, flexible targeting, and pressure tactics that include staged data dumps. None of that general pattern, however, supplies verified detail about the specific Notos Com intrusion beyond the listing itself. Any assertion that alphv made particular demands or released particular Notos Com files must rest on evidence that is not present in the facts given here; the listing is therefore reported as the group’s claim.

Who is Notos Com?

Notos Com, also referred to in corporate descriptions as Notos Com Holdings, is a significant participant in the Greek market for apparel, footwear, and cosmetics. Through successive mergers and acquisitions it has built a portfolio centred on the retail and wholesale management of international brands, with market reach described as both local and global. Organisations of this type typically sit at the intersection of brand licensing, wholesale distribution, retail operations, and the supporting corporate functions—finance, human resources, logistics, and supplier relationships—that keep those channels running.

A breach affecting such a company is consequential because the business handles commercial contracts, pricing and inventory data, employee records, and often customer or partner contact information tied to wholesale and retail activity. Disruption or exposure can affect not only the firm’s own staff but also brand partners and the wider supply chain that depends on timely, confidential commercial information.

What was likely exposed

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of data types—such as employee identifiers, customer lists, financial records, or intellectual property—has been disclosed. Exact contents therefore remain unconfirmed.

Organisations engaged in multi-brand retail and wholesale commonly hold human-resources files, payroll and contractor data, wholesale customer and supplier records, commercial terms, inventory and logistics information, and internal correspondence. It is reasonable to expect that material of those general categories could exist inside a corporate environment of this kind, yet it would be inaccurate to assert that any specific category was present in the stolen set. Until the organisation or a detailed forensic account names the exposed fields, the public position is simply that internal files were taken and that their precise nature is not yet public.

The real-world impact

For individuals, the principal risks are secondary misuse of any personal or contact data that may have been among the internal files, and phishing or social-engineering attempts that leverage knowledge of the company’s brands, colleagues, or commercial relationships. Employees and contractors may face elevated attention from fraudsters who reference the incident or spoof internal addresses. Partners and wholesale customers could see confidential commercial terms or contact details circulate if those were included.

For the organisation, consequences can include operational distraction, legal and regulatory notification duties where personal data is involved, strain on brand-partner relationships, and the longer-term cost of investigation and remediation. Because the scale of the exfiltration and the exact data types remain undisclosed, the severity for any single person cannot be quantified from the public record alone. The prudent stance is to treat the incident as a credible exposure event and to reduce residual risk through ordinary hygiene rather than to assume either total compromise or total safety.

Were you affected?

If you are a current or former employee, contractor, wholesale customer, or close partner of Notos Com, treat unsolicited messages that reference the company, its brands, or this incident with caution. Prefer official channels for any verification. Monitor financial and email accounts for unusual activity, and enable multi-factor authentication where it is available. Consider updating passwords on accounts that may have shared credentials or recovery addresses tied to work. Keep records of any suspicious contact.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. That step does not confirm or deny involvement in this specific incident, but it provides a practical baseline for whether your address is circulating in broader breach corpora and whether further monitoring is warranted.

AICompiled with AI assistance from public sources and published under our editorial standards.