ALB Forex listed on datacarry leak site

• Ransomware group: datacarry
• Country: Türkiye
• Sector: Financial Services
• Announcement date: May 26, 2025

ALB Forex listed on datacarry leak site

The threat actor known as datacarry has listed the Turkish-based brokerage firm ALB Forex on its leak site. This announcement, which appeared on May 26, 2025, indicates that the organization has been targeted by the group in what is described as a data breach incident.

The claims made by datacarry

According to the announcement published by the datacarry group, the threat actor claims to have targeted ALB Forex through a post on their dedicated leak site. The group alleges that they gained unauthorized access to the institution's network. While the announcement was published in May 2025, the group claims the attack itself occurred on October 25, 2024.

In modern cyberattack methodologies, such as double extortion, ransomware groups often follow a pattern where they not only encrypt an organization's systems but also exfiltrate sensitive information. The goal of this tactic is to pressure the victim into paying a ransom by threatening to leak the stolen data publicly. By listing a company on a leak site, these actors aim to increase visibility and pressure the target to meet their demands.

Details regarding the alleged data breach

Despite the claims made by the datacarry group regarding unauthorized access to the network, the group has not provided specific details or samples regarding the content of the allegedly leaked data. Furthermore, no information has been provided regarding the total size of the data or the specific number of files involved in the incident. The listing does not specify a ransom demand or any other terms for the return of the data.

The listing names no specific data types that have been compromised.

Risk assessment and implications

This incident may pose a risk of exposure for customer financial data. If the claims made by the datacarry group are verified, obligations regarding data breach notifications under regulations such as KVKK could arise. The potential exposure of sensitive information often triggers legal and regulatory requirements to inform both authorities and the affected individuals.

As a secondary risk, the leaked data could potentially be utilized for identity theft or targeted phishing campaigns. When sensitive information is exposed, threat actors often use it to craft highly convincing social engineering attacks, making it difficult for users to distinguish between legitimate communications and fraudulent ones.

About ALB Forex

ALB Forex is a Turkey-based brokerage firm that offers investors the opportunity to trade leveraged financial instruments such as currencies, commodities, and indices. Operating under the supervision of the Capital Markets Board of Turkey (SPK), the company provides financial market services through online trading platforms.

Industry security considerations

Information regarding the datacarry group is limited in the public domain. For organizations operating within the financial services sector, such incidents highlight the importance of robust security postures. It may be advisable for institutions to review their security measures and implement proactive monitoring against potential data breaches.

Common defensive steps for organizations in high-stakes sectors include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security audits. Furthermore, continuous monitoring of network traffic can help detect unauthorized access attempts before significant data exfiltration occurs. Maintaining a comprehensive incident response plan is also a critical component of organizational resilience against ransomware-related threats.