{ "id": "454d195b-ce1d-4ebe-a0a8-58e4cbfc3469", "created_at": "2026-04-06T00:07:14.184774Z", "updated_at": "2026-04-10T03:29:39.816705Z", "deleted_at": null, "sha1_hash": "9fab0b656d16b401f161432e02e3572255c6ea9a", "title": "BlackCat (ALPHV) claims Swissport ransomware attack, leaks data", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 2485432, "plain_text": "BlackCat (ALPHV) claims Swissport ransomware attack, leaks data\r\nBy Ax Sharma\r\nPublished: 2022-02-15 · Archived: 2026-04-05 15:43:30 UTC\r\nThe BlackCat ransomware group, aka ALPHV, has claimed responsibility for the recent cyber attack on Swissport that\r\ncaused flight delays and service disruptions.\r\nThe €3 billion revenue firm, Swissport, has a presence across 310 airports in 50 countries and provides cargo handling,\r\nmaintenance, cleaning, and lounge hospitality services.\r\nBlackCat has now been seen by BleepingComputer to leak a minuscule set of terabytes of data supposedly obtained from the\r\nrecent ransomware attack.\r\nhttps://www.bleepingcomputer.com/news/security/blackcat-alphv-claims-swissport-ransomware-attack-leaks-data/\r\nPage 1 of 5\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/blackcat-alphv-claims-swissport-ransomware-attack-leaks-data/\r\nPage 2 of 5\n\nVisit Advertiser websiteGO TO PAGE\r\nBlackCat starts leaking data\r\nAs reported by BleepingComputer,  the cargo and hospitality services giant had earlier disclosed a ransomware attack on its\r\nsystems.\r\nToday, BlackCat (ALPHV) ransomware group has posted a small set of sample files that the group claims to have\r\nobtained from Swissport.\r\nThe threat actor has announced they are willing to sell the entire 1.6 TB \"data dump\" to a prospective buyer:\r\nBlackCat (ALPHV) ransomware op claims to have 1.6 TB of Swissport's data (DarkTracer)\r\nThe data leak page seen by BleepingComputer today contains images of passports, internal business memos, and what\r\nappear to be details of job candidates, such as their:\r\nFull name\r\nPassport Number\r\nNationality\r\nReligion (Muslim or Non-Muslim indicator)\r\nEmail\r\nPhone number\r\nJob role, interview scores, and other recruitment information\r\nBleepingComputer has reached out to Swissport to better understand what this data represents, notably the flag indicator\r\nrecording the religion of job candidates:\r\nhttps://www.bleepingcomputer.com/news/security/blackcat-alphv-claims-swissport-ransomware-attack-leaks-data/\r\nPage 3 of 5\n\nThe leaked table has information of job candidates (BleepingComputer)\r\nWith its 66,000 employees worldwide, Swissport handles 282 million passengers and 4.8 million tons of cargo every year,\r\nmaking it a vital link in the global aviation travel industry chain.\r\nAs such, while the cyberattack on Swissport was \"largely contained\" with systems fully cleaned and restored, questions\r\nremain as to what happens to sensitive data that threat actors may have gotten their hands on.\r\nBlackCat emerged after BlackMatter's shut down\r\nDubbed the \"most sophisticated\" ransomware group of 2021, BlackCat ransomware group emerged after BlackMatter's shut\r\ndown by law enforcement.\r\nThis month, BlackCat members confirmed they are indeed linked to the BlackMatter/DarkSide operation.\r\nWhile the ransomware gang calls themselves ALPHV, security researcher MalwareHunterTeam previously named the\r\nransomware BlackCat after the group used the image of a black cat on every victim's Tor payment page. Since then, the\r\nransomware operation has been known as BlackCat when discussed in the media or by security researchers.\r\nBleepingComputer is aware of multiple victims targeted by this ransomware gang since November 2021 from numerous\r\ncountries, including the USA, Australia, and India.\r\nRansom demands typically range between $400,000 to $3 million payable in Bitcoin or Monero. Victims paying in bitcoin\r\nincur an additional 15% fee on top of the demanded ransom.\r\nAs an additional extortion method, the BlackCat threat actors threaten to DDoS victims until they pay a ransom.\r\nOverall, this is a highly sophisticated ransomware operation with the threat actors clearly considering all aspects of attacks.\r\nhttps://www.bleepingcomputer.com/news/security/blackcat-alphv-claims-swissport-ransomware-attack-leaks-data/\r\nPage 4 of 5\n\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/blackcat-alphv-claims-swissport-ransomware-attack-leaks-data/\r\nhttps://www.bleepingcomputer.com/news/security/blackcat-alphv-claims-swissport-ransomware-attack-leaks-data/\r\nPage 5 of 5", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "references": [ "https://www.bleepingcomputer.com/news/security/blackcat-alphv-claims-swissport-ransomware-attack-leaks-data/" ], "report_names": [ "blackcat-alphv-claims-swissport-ransomware-attack-leaks-data" ], "threat_actors": [ { "id": "86ab9be8-ce67-4866-9f66-1df471e9d251", "created_at": "2024-05-29T02:00:03.942487Z", "updated_at": "2026-04-10T02:00:03.641939Z", "deleted_at": null, "main_name": "Alpha Spider", "aliases": [ "ALPHV Ransomware Group" ], "source_name": "MISPGALAXY:Alpha Spider", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "6e23ce43-e1ab-46e3-9f80-76fccf77682b", "created_at": "2022-10-25T16:07:23.303713Z", "updated_at": "2026-04-10T02:00:04.530417Z", "deleted_at": null, "main_name": "ALPHV", "aliases": [ "ALPHV", "ALPHVM", "Ambitious Scorpius", "BlackCat Gang", "UNC4466" ], "source_name": "ETDA:ALPHV", "tools": [ "ALPHV", "ALPHVM", "BlackCat", "GO Simple Tunnel", "GOST", "Impacket", "LaZagne", "MEGAsync", "Mimikatz", "Munchkin", "Noberus", "PsExec", "Remcom", "RemoteCommandExecution", "WebBrowserPassView" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775434034, "ts_updated_at": 1775791779, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/9fab0b656d16b401f161432e02e3572255c6ea9a.pdf", "text": "https://archive.orkl.eu/9fab0b656d16b401f161432e02e3572255c6ea9a.txt", "img": "https://archive.orkl.eu/9fab0b656d16b401f161432e02e3572255c6ea9a.jpg" } }