Alphalocker ransomware group lists www.unterkofler.info on its leak site

• Ransomware group: Alphalocker
• Country: Austria
• Announcement date: November 3, 2025

Alphalocker claims data breach at Unterkofler

The threat actor known as Alphalocker has listed data allegedly belonging to the organization www.unterkofler.info on their dedicated leak site. In an announcement made on November 3, 2025, the group claimed to have successfully compromised the target, asserting that they are in possession of a significant volume of the company's sensitive information.

The claim involves a total data size of 117 GB. While the group has published this information on their leak site, public information regarding the specific capabilities and background of the Alphalocker group remains limited. This incident follows a pattern often seen in modern cyberattacks where threat actors use leak sites to exert pressure on their victims through the threat of public data exposure.

Details of the alleged data theft

According to the announcement and associated screenshots provided by the threat actor, the stolen information is quite diverse, spanning various administrative and operational categories. The group alleges that the compromised files include a wide range of sensitive documentation that could impact the organization's internal and external operations. The specific types of data mentioned in the listing include:

• Bank records
• Personnel information
• Customer data
• Tax documents
• Corporate documents

The presence of such varied data types suggests a broad access level within the victim's network during the alleged intrusion. The inclusion of financial and personal information is a common tactic used by ransomware operators to increase the leverage they hold over a target during negotiations.

About Unterkofler

Unterkofler is a family-owned business based in Grossarl, Austria. The company operates within the construction, excavation, and building materials sector. They specialize in providing construction services and managing local infrastructure projects, making them a key player in their regional industry.

Risk assessment and implications

The alleged leak of this data may pose secondary risks to the organization's operational processes and its employees. Because the organization is based in Austria, it may face specific data protection obligations under the General Data Protection Regulation (GDPR). The publication of such sensitive information can trigger significant risks, including the potential for identity theft or the execution of targeted phishing attacks directed at the organization's customers and employees.

The fact that the group appears to be employing double-extortion tactics is significant. In a double-extortion scenario, attackers do not merely encrypt a company's systems to disrupt operations; they also steal sensitive data to threaten the victim with its public release. This method is designed to pressure the organization into meeting ransom demands to prevent the exposure of proprietary or personal information.

For organizations operating in sectors involving physical infrastructure and local services, maintaining robust cybersecurity posture is essential. General defensive steps for organizations facing such threats include implementing strict access controls, maintaining offline backups, and conducting regular security awareness training for employees to mitigate the risk of phishing. Furthermore, ensuring compliance with regional data protection laws is a critical component of managing the fallout from potential data breaches.