Requena Listed by alphv Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continued through 2022 to list public-sector and government-adjacent organisations on leak sites, treating stolen internal files as leverage whether or not a ransom was paid. In that climate, the appearance of a Spanish government-sector entity on an alphv listing was one more signal that administrative and municipal data remained a routine target.

On 6 December 2022, Requena, a company operating in the government industry in Valencia, Spain, was listed by the alphv ransomware group. The group claimed that internal files had been exfiltrated in a ransomware attack. The number of people affected remains unknown, and public detail beyond the listing itself is limited. For anyone whose information may have been held by the organisation, the claim alone is reason to understand what is known and what practical steps follow.

What happened

According to the reported record, Requena was listed by alphv on 6 December 2022. The listing described the incident as a ransomware attack in which internal files were allegedly exfiltrated. No confirmed figure for individuals affected has been published, and the precise timing of the intrusion, the initial access method, and the full scope of systems involved have not been disclosed in the available facts. The public record therefore rests on the group’s claim that data was taken and that the organisation had been named on its leak site. Whether the listing was later followed by a full data release, a negotiated settlement, or other outcome is not stated in the facts provided.

Inside alphv

alphv, widely known in security reporting as BlackCat, operated as a ransomware-as-a-service operation. Affiliates gained access to victim networks, exfiltrated data, and deployed encryption, while the core group provided the malware, negotiation infrastructure, and leak-site platform. The model typically combined double extortion: encryption of systems plus the threat to publish stolen files if payment was not made. alphv was noted for a rust-based ransomware variant, customisable payloads, and a professionalised leak site on which victims were named and, in many cases, sample files were posted to pressure payment. The group’s activity against a wide range of sectors, including government and critical services, was extensively documented by researchers and law-enforcement advisories before the brand later fractured under pressure. In this incident, the only specific claim tied to Requena is the leak-site listing itself; no further statements by the group about this victim are included in the facts.

Requena and its sector

Requena is described as a company operating in the government industry, based in Valencia, Spain. Organisations in this sector commonly support public administration, municipal or regional services, or related government functions. They typically hold internal operational documents, correspondence, employee records, and data linked to citizens or other public bodies. A breach affecting such an entity matters because government-sector data often includes information that cannot be changed as easily as a password—identifying details, case or service records, and internal decision-making material—and because disruption or exposure can affect both staff and the public who rely on those services. The facts do not elaborate Requena’s exact mandate or the systems involved; they establish only the sector, location, and the alphv listing.

What was likely exposed

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of file types, databases, or record counts is provided, and the number of people affected is unknown. Organisations in the government sector commonly maintain personnel files, internal reports, contracts, email archives, and records connected to public services or citizens. It is reasonable to expect that material of that general character could have been among any stolen internal files, yet the exact contents remain unconfirmed. Readers should treat any specific category beyond “internal files” as unverified until corroborated by the organisation or by independent analysis of published samples, neither of which is supplied in the available record.

Why it matters

When internal government-sector files are taken, the practical risks are concrete. Staff may face exposure of personal or employment data that can be used in phishing or identity fraud. Citizens or partner bodies whose information appears in those files may see sensitive administrative details circulate. The organisation itself can face operational disruption, regulatory scrutiny, and the long-term task of verifying what left the network. Because the scale of this incident is undisclosed, it is not possible to quantify how many individuals are implicated; the absence of a public count does not mean the risk is zero. alphv’s listing is a claim, not an independent confirmation of every detail, yet historically such listings have often preceded or accompanied real data exposure. Affected parties therefore have grounds to monitor for misuse of personal information and to treat unsolicited contacts that reference the organisation with caution.

If your data was in this claimed breach

If you have a relationship with Requena—as an employee, contractor, service user, or partner—assume that internal files could include your details until the organisation states otherwise. Change passwords on related accounts, enable multi-factor authentication where available, and watch financial and government-related accounts for unusual activity. Be sceptical of emails or calls that cite the incident and press for urgent action or payment. Keep records of any suspicious contact. You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets, which offers a practical starting point for deciding what else to monitor.

AICompiled with AI assistance from public sources and published under our editorial standards.