The Royal Commission for Riyadh City (RCRC) Listed by alphv Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
The The Royal Commission for Riyadh City (RCRC) Listed by alphv Ransomware Group (reported July 7, 2022) is an unverified claim; the data involved is undisclosed belonging to roughly unknown people. If you have an account with them, your information may now be circulating on the open web and with data brokers. Here’s exactly what happened, how to check if you were affected, and what to do next.
What happened
The incident was first noted publicly when alphv added RCRC to its data-leak site on July 7, 2022. The group stated that internal files had been taken from the organisation. No information has been released about the date of the intrusion itself, the method of access, the quantity of data removed, or whether any systems were encrypted. The organisation has not issued a public statement confirming or denying the claims.
Who is alphv?
Alphv, also tracked publicly as BlackCat, is a ransomware-as-a-service operation that emerged in late 2021. The group supplies encryption tools to affiliate attackers and routinely pairs file encryption with the theft of data, which it then threatens to publish. It maintains a Tor-based leak site where it lists organisations it claims to have compromised. Alphv has been linked to intrusions across multiple countries and sectors, though each listing on its site represents an unverified claim by the group until independently confirmed.
About The Royal Commission for Riyadh City (RCRC)
The Royal Commission for Riyadh City is a Saudi government body tasked with the comprehensive planning and development of Riyadh. Its responsibilities span urban design, demographic studies, economic development, transport networks, infrastructure projects, environmental management, and digital infrastructure. The commission also oversees the delivery of public services and facilities across the city. Entities of this type routinely collect and store records related to land use, project contracts, resident services, and long-term city planning.
What was likely exposed
The only detail released is that internal files were allegedly exfiltrated. The exact categories of data, file counts, or time periods covered have not been disclosed. Organisations with RCRC’s mandate typically hold planning documents, contractor information, demographic datasets, and records connected to public-service delivery. Whether any of these categories were among the files taken remains unconfirmed.
Why it matters
City-planning records can contain sensitive operational details whose exposure may affect ongoing projects or future development decisions. If personal information relating to residents or contractors is present, those individuals could face risks of identity misuse or targeted fraud. For the organisation, the incident adds to the operational burden of assessing scope, notifying relevant authorities, and strengthening controls, even though the precise impact is still unknown.
If your data was in this claimed breach
Individuals concerned about possible exposure should monitor their financial and government-service accounts for unusual activity. Enabling multi-factor authentication on any accounts that may be linked to Riyadh city services is a practical first step. Readers can also run a free exposure scan of their email address against known breach data to check whether their information appears in public listings from this or other incidents.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
ELOTECH - HACKED AND MORE THEN 100 GB DATA LEAKED! Listed by alphv Ransomware GroupPhilippine Economic Zone Authority (PEZA) pezagovph Listed by alphv Ransomware GroupComando Conjunto de las Fuerzas Armadas Del Ecuador Listed by alphv Ransomware Group( POST HAS BEEN UPDATED 1400GB LEAK AVAILABLE ) County Suffolk and contractors Listed by alphv Ransomware GroupLatest breaches
Publicly posted by alphv — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.