nubox.com & sumasaas.com Listed by alphalocker Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target software and SaaS providers as a high-value vector in the current threat landscape, using data theft and public listings to pressure victims. On September 08, 2025, the alphalocker ransomware group listed nubox.com and sumasaas.com on its leak site, claiming a successful attack that involved the exfiltration of internal files. The number of people affected remains unknown, and public detail on the full scope is limited, but the claim of 150 GB of data including contracts, projects, clients and customers underscores why such incidents matter to businesses and individuals whose information may now be at risk of further exposure or misuse.

This listing fits a pattern of double-extortion tactics in which groups steal data before or alongside encryption, then advertise the haul to force payment. While the claim has not been independently confirmed in available records, it places the organisations and anyone connected to them in a position where vigilance is warranted.

Breaking down the breach

According to the reported summary, alphalocker claims to have conducted a ransomware attack against nubox.com and sumasaas.com that resulted in the exfiltration of internal files. The group states that 150 GB of data was taken, encompassing contracts, projects, clients, customers and similar materials. The incident was reported on September 08, 2025. No further public detail has been provided on the precise method of intrusion, the duration of access, whether systems were encrypted, or any ransom demand. The number of people affected is listed as unknown. Because the information originates from the group’s own leak-site listing, it must be treated as an unverified claim rather than established fact until corroborated by the organisations or independent investigators.

Inside alphalocker

Alphalocker is a ransomware operation that follows the well-documented double-extortion model used by many contemporary groups. Actors typically gain initial access through phishing, exploited vulnerabilities or compromised credentials, then move laterally to identify and copy valuable data before deploying encryption. Once data is exfiltrated, the group lists the victim on a dedicated leak site, often with sample files or volume claims, to increase pressure for payment. Public reporting on alphalocker has noted its focus on mid-sized commercial targets and its practice of advertising stolen archives containing business documents. In this case the group claims the nubox.com and sumasaas.com data set totals 150 GB and includes contracts, projects, clients and customers; no additional statements from the group about these specific victims appear in the available record. As with other ransomware actors, listings serve both as proof-of-compromise and as a marketplace signal that the data may later be sold or released if negotiations fail.

Who is nubox.com & sumasaas.com?

Nubox.com and sumasaas.com appear to operate in the software-as-a-service and business-application sector, providing tools that organisations use to manage accounting, projects, client relationships or related administrative functions. Companies of this type typically store contracts, project documentation, client and customer records, and internal operational files on behalf of their users. A breach affecting such platforms is consequential because the data often spans multiple third-party businesses and individuals rather than a single corporate entity. Even when the precise nature of the services is not detailed in public breach records, the presence of client and customer information means the impact can extend well beyond the named organisations themselves.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack and that the claimed volume is 150 GB of data covering contracts, projects, clients, customers and similar categories. Exact file inventories, formats or additional data types have not been disclosed. Organisations operating SaaS platforms of this kind commonly hold business contracts, project plans, contact details, billing records and correspondence. Because the precise contents remain unconfirmed beyond the group’s summary, it is not possible to state with certainty which specific records were taken or how many individuals are represented in the set. Readers should therefore treat the listed categories as the only publicly asserted scope.

What's at stake

For individuals whose details appear in client or customer files, the primary risks include targeted phishing, social-engineering attempts that reference genuine contracts or projects, and potential identity misuse if personal identifiers are present. Businesses whose contracts or project data were included face competitive exposure, contractual disputes and the administrative burden of notifying their own customers. The organisations themselves confront operational disruption, potential regulatory scrutiny and reputational harm. Because the number of people affected is unknown and the full data set has not been independently verified, the concrete scale of these risks cannot yet be quantified; the mere existence of a 150 GB claim is sufficient to justify precautionary measures by anyone who has interacted with the platforms.

What to do if you're exposed

If you have used services associated with nubox.com or sumasaas.com, begin by monitoring financial and email accounts for unusual activity and enable multi-factor authentication wherever it is available. Review any contracts or project communications you have shared for sensitive details that could be leveraged in scams. Change passwords on related accounts and consider placing fraud alerts with credit bureaus if personal identifiers may have been involved. Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. Stay alert for official statements from the organisations, as further Reported Details may emerge over time.

AICompiled with AI assistance from public sources and published under our editorial standards.