AlertEnterprise listed on VanHelsing ransomware leak site

• Ransomware group: VanHelsing
• Country: United States
• Sector: Technology
• Announcement date: March 31, 2025

The VanHelsing ransomware group has officially listed the technology company alertenterprise.com on its dedicated leak site. This announcement, made on March 31, 2025, marks a significant development in the ongoing threat landscape involving specialized software providers. While the group has claimed responsibility for the attack, the incident highlights the persistent risks faced by organizations managing critical digital and physical security infrastructures.

The details of the claim

According to the announcement published by the VanHelsing group on March 31, 2025, the threat actor has added alertenterprise.com to their public leak site. To support their claim of a successful intrusion, the group has released a file tree image that they assert belongs to the internal systems of the organization. This visual evidence is intended to demonstrate the level of access achieved by the attackers during the breach.

Furthermore, the group's post includes references to the company's customer list. In their announcement, they specifically mention several large-scale corporations, suggesting that the breach may extend beyond the organization's internal environment to include information regarding its client base. This tactic is common among modern ransomware groups, who often use the threat of exposing client identities to increase pressure on the victimized organization.

Data and files involved

The evidence provided by the VanHelsing group points toward the compromise of specific system directories and files. Based on the screenshots released by the group, the following data types have been identified as being potentially affected:

• Backup files

Specifically, the group shared a screenshot displaying numerous files with a '.bak' extension. These files were located within the 'DISK_E' directory of a server identified by the IP address '172.16.32.72'. The presence of these backup files is particularly concerning, as they often contain historical snapshots of databases and critical system configurations.

About AlertEnterprise

AlertEnterprise is a technology company that specializes in providing software solutions for physical access control, identity management, and workspace automation. The company develops various platforms designed to assist businesses in securing both their physical and digital assets. Given the nature of their service offerings, the organization plays a role in the security infrastructure of the companies they serve.

Security implications and industry risks

This incident may pose significant security risks to the organization's critical operational areas, particularly in the domains of physical access control and identity management. The allegedly leaked backup files could contain sensitive information belonging to both the company and its various clients. Because the organization is based in the United States, any confirmed data loss could trigger mandatory notification obligations under relevant state laws and federal regulations.

The mention of large corporations in the leaked customer list introduces additional risks, such as the potential for supply chain attacks and targeted phishing attempts against the organization's clients. When a service provider is compromised, the downstream impact on their customers can be substantial, as attackers may use the gained information to launch more sophisticated, targeted campaigns.

In the broader context of cybersecurity, ransomware groups often employ double extortion tactics. This involves not only encrypting a victim's data to disrupt operations but also stealing sensitive information to threaten its public release. Organizations in the technology and security sectors often implement defensive measures such as robust encryption, multi-factor authentication, and strict network segmentation to mitigate these risks. However, as seen in this case, the targeting of backup directories remains a high-priority threat for many threat actors. Information regarding the specific capabilities and identity of the VanHelsing group remains limited at this time.