Alexandria (LA) data breach claimed by ALPHV

• Ransomware group: ALPHV
• Country: United States
• Sector: Government & Defense
• Announcement date: July 26, 2023

The ALPHV ransomware group has claimed responsibility for a data breach targeting the City of Alexandria (LA), asserting that they have successfully compromised the organization's networks and exfiltrated a significant volume of sensitive information.

Details of the claimed attack

According to the announcement posted on the group's leak site on July 26, 2023, the ALPHV (also known as BlackCat) group claims to have breached the networks of the City of Alexandria (LA). The group alleges that they have exfiltrated over 80 GB of data from the institution. To exert pressure on the target, the threat actors have utilized common double-extortion tactics by posting file trees and various documents related to the institution on their leak site.

Updates provided in the leak site post indicate that the institution did not engage in communication with the attackers. Consequently, the group has proceeded to publish the stolen data. While the group's activities reportedly ceased as of March 2024, the publication of this historical data may continue to pose long-term security risks to the affected parties.

Data involved in the breach

The information released by the group includes various administrative and sensitive documents. Screenshots provided by the attackers display a wide range of internal records. The data said to be involved includes:

• Payroll records
• Personnel leave records
• Financial reports
• Property records
• Administrative documents

The exposure of such diverse datasets suggests a deep intrusion into the municipal systems, potentially compromising various departments within the local government structure.

About the organization

Alexandria is a city located in the state of Louisiana, United States. As a local government entity, it provides essential municipal services to its residents.

Security implications and risks

This breach may lead to the exposure of personal data belonging to both employees and citizens of the City of Alexandria (LA). Such attacks against public institutions can create significant secondary risks, including the potential for identity theft and the launch of targeted phishing campaigns against the individuals whose data has been leaked.

Furthermore, the institution may face legal liabilities under US state laws and various data protection regulations due to the exposure of this information. The ALPHV group is known for employing Rust-based malware and utilizing double-extortion tactics, a method where attackers not only encrypt data but also threaten to leak it to maximize their leverage.

In the broader context of cybersecurity, attacks on government and defense sectors are particularly disruptive because they target the core services that maintain social order and public trust. Organizations in this sector often face heightened risks due to the vast amount of sensitive personal and financial data they manage. To mitigate such risks, defensive strategies typically involve implementing robust network segmentation, maintaining rigorous patch management programs, and conducting regular security awareness training to prevent initial access via phishing. Additionally, maintaining offline, immutable backups and implementing strong multi-factor authentication (MFA) across all administrative interfaces are critical steps in defending against modern ransomware threats.