Alphalocker ransomware group lists www.mercantetubos.com.br on its leak site

• Ransomware group: Alphalocker
• Country: Brazil
• Sector: Manufacturing
• Announcement date: October 13, 2025

Alphalocker claims data theft from Mercante Tubos

The threat actor known as Alphalocker has announced the alleged leak of a significant amount of data belonging to the Brazilian manufacturing company Mercante Tubos (www.mercantetubos.com.br). According to an announcement made on the group's leak site on October 13, 2025, the group claims to have obtained 200 GB of data from the organization's network.

The incident was reported on the same day the group claims to have carried out the attack. While the group has listed the data for publication, no ransom demand has been specified in the announcement. This type of activity is often associated with a double-extortion strategy, a common tactic used by ransomware groups where attackers not only encrypt a victim's systems but also steal sensitive information to pressure the organization into paying a ransom to prevent the public release of the stolen data.

Details of the alleged data exposure

The threat actor claims to have successfully infiltrated the organization's network and has provided a directory structure to demonstrate the scope of the breach. This structure reportedly contains various folders related to the company's internal operations. The group appears to be actively exerting pressure on the organization by utilizing a countdown timer, a common psychological tactic used by ransomware groups to induce urgency and force a response from the victim.

Based on the information provided by the group, the leaked content is said to include a wide variety of sensitive documentation. The specific types of data mentioned in the claim include:

• Financial records
• Logistics documents
• Human resources data
• Tax documents
• Employee personal data

The exposure of such diverse datasets suggests a deep level of access into the company's operational and administrative environments.

About Mercante Tubos

Mangueira Indústria e Comércio de Tubos e Aços Especiais Ltda., operating under the domain mercantetubos.com.br, is a Brazilian company that was founded in 1972. The organization specializes in the import and distribution of special mechanical steel tubes. Furthermore, the company provides a diverse range of steel pipes and various derivatives intended for various industrial applications.

Impact and organizational implications

The alleged leak of this data could have profound implications for the organization. From an operational standpoint, the exposure of internal documents may negatively impact the company's operational continuity and its commercial reputation within the manufacturing industry. Furthermore, the exposure of employee personal data carries significant risks, including the potential for identity theft and the execution of targeted phishing attacks against the company's staff.

From a regulatory perspective, the organization may face administrative sanctions under Brazil's LGPD (Lei Geral de Proteção de Dados) regulations, as these laws impose strict obligations regarding the protection and handling of personal data. Given the potential complexity of such a breach, a comprehensive forensic investigation is typically required to determine the full scope and exact nature of the leaked information.

In general, when organizations face such threats, defensive measures often involve strengthening network segmentation, implementing robust access controls, and maintaining regular, offline backups. Because public information regarding the Alphalocker group remains limited, organizations are encouraged to remain vigilant against the evolving tactics used in double-extortion ransomware campaigns.