Ransom Ledger

ALPHV

Also known as BlackCat, Noberus

Ran the Change Healthcare attack and counted Scattered Spider among its affiliates. In March 2024 it took the $22 million Change payment, cut out the affiliate and shut down behind a fake police seizure notice.

What it is
Ransomware-as-a-service
Based
Russian-speaking
Active
2021–2024
Status
Defunct

On the record

  1. May 2024 · US Senate Finance Committee

    UnitedHealth's CEO tells the Senate the decision to pay Change Healthcare's ransom was his

  2. Mar 2024 · The Record

    Europol, the DOJ and the NCA deny any part in the 'seizure' notice on ALPHV's leak site

  3. Mar 2024 · BleepingComputer

    BlackCat shuts down in an apparent exit scam and blames the FBI

In the ledger

$22 million paid in the one payment listed

  • Mar 2024Change Healthcare (UnitedHealth Group) paid $22 million. Confirmed by the victim.

One outage listed

  • Feb 2024Change Healthcare: $2.87 billion. UnitedHealth's own estimate of the 2024 cost.