The Keen Group Listed by alphv Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure smaller service businesses by stealing internal files and threatening public release, a pattern that has become common across logistics and local transport. In that landscape, The Keen Group was listed by the alphv ransomware group in a claim dated 23 February 2023. Public detail remains limited: the number of people affected is unknown, and the only description of what was taken is that internal files were allegedly exfiltrated in a ransomware attack. For customers, drivers, and partners of a south London minicab and courier firm, even an unverified listing raises practical questions about what may have left the organisation’s systems and how to respond.

This article sets out only what has been reported, places the claim in context, and explains the ordinary risks that follow when a transport operator’s internal files are said to have been stolen. Nothing here asserts that the listing has been independently confirmed or that any specific personal record has been proven exposed.

Inside the incident

According to the available record, The Keen Group was listed by the alphv ransomware group on 23 February 2023. The report states that internal files were exfiltrated in a ransomware attack. No further operational detail has been disclosed publicly: the precise date of intrusion, the initial access method, the volume of data, any ransom demand, or whether systems were encrypted as well as copied are all unconfirmed. The number of people affected is listed as unknown.

What is known is therefore narrow. A ransomware group associated with data-theft and leak-site pressure claimed the organisation as a victim and described the material as internal files taken during an attack. Beyond that claim and the reported date, public information does not establish the full scope or the current status of any negotiation or release. Readers should treat the listing as an assertion by the group rather than as independently verified fact unless further confirmation appears.

Who is alphv?

Alphv, also widely known in public reporting as BlackCat, is a ransomware operation that emerged in late 2021 and became one of the more prominent Ransomware-as-a-Service groups of the following years. It has typically operated by recruiting affiliates who gain access to victim networks, exfiltrate data, deploy encryption, and then use a dedicated leak site to name organisations and threaten publication if payment is not made. The group has been linked in open sources to attacks across multiple sectors and countries, often emphasising double-extortion: theft of files combined with the threat of public dump.

Public technical reporting has described alphv tooling as relatively sophisticated for its time, including a Rust-based ransomware payload and flexible negotiation portals. Like other groups of its type, it has relied on the credibility of its leak site—listing victims and sometimes releasing sample files—to increase pressure. None of that established background, however, proves the specific contents or authenticity of any single listing. In this case, the facts state only that The Keen Group appeared on the group’s listings with a claim of internal-file exfiltration; no additional statements attributed to alphv about this victim are part of the public record used here.

The Keen Group and its sector

The Keen Group is described in the reported summary as a professional, licensed minicab and courier service operating across south London. Firms of this kind arrange passenger journeys and the movement of goods, typically coordinating drivers, vehicles, bookings, and customer requests. They sit in a sector that handles scheduling, contact details, payment arrangements, and operational records necessary to run a licensed private-hire and courier business.

A breach claim against such an operator matters because the business sits between private individuals, corporate clients, and drivers. Even when the exact data set is undisclosed, the ordinary functions of minicab and courier work mean the organisation is likely to process names, phone numbers, addresses or pick-up points, journey histories, and related administrative files. Disruption or exposure can affect service continuity, regulatory standing, and the trust of people who rely on the firm for transport. The listing therefore carries weight for a local operator even when scale and precise contents remain unknown.

What data was at risk

The facts name the exposed material only as “internal files exfiltrated in a ransomware attack.” No inventory of file types, no count of records, and no confirmation of customer, driver, or financial data have been published in the material available for this account. It is therefore not possible to state as fact that any particular category of personal information was taken.

Organisations that run licensed minicab and courier services commonly hold booking and dispatch records, customer contact details, driver information, vehicle and licensing documentation, invoices, and internal correspondence. Those categories are typical of the sector; they are not confirmed contents of this incident. Until a fuller disclosure or independent verification appears, the exact data at risk should be treated as unconfirmed beyond the general description of internal files.

What's at stake

For individuals, the practical risks of internal-file theft from a transport operator include unwanted contact, phishing that references real journeys or account details, and misuse of addresses or phone numbers if such data were present. Identity-related fraud is a longer-term concern when names and contact information circulate, though no specific identity documents are named in the facts. Drivers and staff could face similar exposure of personal or employment-related records if those files were among those taken.

For the organisation, stakes include operational disruption, potential regulatory attention around data protection and licensing, reputational harm among south London customers, and the cost of investigation and recovery. Because the number of people affected is unknown and the file contents are not detailed, the concrete impact cannot be quantified from public information alone. The prudent stance is to recognise real but unconfirmed exposure rather than to assume either a clean bill of health or a catastrophic dump.

If your data was in this claimed breach

If you have used The Keen Group for minicab or courier services, or if you work with the firm, treat the alphv listing as a reason for caution rather than proof that your records were taken. Monitor bank and card statements for unfamiliar charges, be sceptical of unexpected messages that claim to relate to a past booking, and avoid clicking links or supplying passwords in response to unsolicited contact. Consider changing passwords on any accounts that shared an email address or phone number with the company, especially if you reused credentials. If you are a driver or contractor, review any portals or apps you use for work and enable stronger authentication where available.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. That step does not confirm or deny involvement in this specific incident, but it can show whether your address is circulating more widely and help you prioritise further precautions. Keep records of any suspicious contact and report clear fraud attempts to the relevant authorities and your bank. Public detail on this event remains limited; measured personal vigilance is the proportionate response while fuller facts are unavailable.

AICompiled with AI assistance from public sources and published under our editorial standards.