Operator dossier

MYDATA / ALPHA LOCKER is a ransomware operator currently active on public leak sites. Darkfield has indexed 16 public victims claimed by this operator between May 14, 2026 and June 10, 2026. MYDATA / ALPHA LOCKER is an emerging ransomware group first observed in May 2026 with financial extortion as its primary motivation, currently representing a nascent threat actor with a very limited publicly documented operational history. Given the extremely limited public reporting available from authoritative sources such as CISA, the FBI, Mandiant, or established security research organizations, the group's origin, affiliation, and infrastructure details remain largely unattributed and unconfirmed at this time. Based on available victim telemetry, the group has targeted at least one organization in Greece with a focus on the manufacturing sector, suggesting either opportunistic targeting or early-stage sector-specific reconnaissance, though no definitive attack methodology, initial access vectors, or encryption tooling details have been publicly documented to a verifiable standard. No notable high-profile campaigns, record ransom demands, or law enforcement actions have been publicly attributed to MYDATA / ALPHA LOCKER as of the time of this assessment. The group appears to be in its earliest operational phase, and its current status, including whether it operates as a Ransomware-as-a-Service model or as an independent closed group, cannot be confirmed without additional corroborating intelligence from authoritative sources; continued monitoring is warranted given its recent emergence.

Recent disclosures by MYDATA / ALPHA LOCKER

All 16 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for MYDATA / ALPHA LOCKER →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

MYDATA / ALPHA LOCKER

16 victims indexed · first seen 2 months ago · last activity 1 month ago

Victims indexed

#174 of 364 tracked operators

Active period

May 2026 → Jun 2026

—

Countries hit

At a glance

Status: active
First seen: 2 months ago
Last activity: 1 month ago
Onion sites: 1 known endpoint

About

MYDATA / ALPHA LOCKER is an emerging ransomware group first observed in May 2026 with financial extortion as its primary motivation, currently representing a nascent threat actor with a very limited publicly documented operational history. Given the extremely limited public reporting available from authoritative sources such as CISA, the FBI, Mandiant, or established security research organizations, the group's origin, affiliation, and infrastructure details remain largely unattributed and unconfirmed at this time. Based on available victim telemetry, the group has targeted at least one organization in Greece with a focus on the manufacturing sector, suggesting either opportunistic targeting or early-stage sector-specific reconnaissance, though no definitive attack methodology, initial access vectors, or encryption tooling details have been publicly documented to a verifiable standard. No notable high-profile campaigns, record ransom demands, or law enforcement actions have been publicly attributed to MYDATA / ALPHA LOCKER as of the time of this assessment. The group appears to be in its earliest operational phase, and its current status, including whether it operates as a Ransomware-as-a-Service model or as an independent closed group, cannot be confirmed without additional corroborating intelligence from authoritative sources; continued monitoring is warranted given its recent emergence.

Recent victims

Loading…

Onion infrastructure

1 known

http://mydatae2d63il5oaxxangwnid5loq2qmtsol2ozr6vtb7yfm5ypzo6id.onion/blog

Source

Updated 1 month ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time MYDATA / ALPHA LOCKER posts a victim.

Add MYDATA / ALPHA LOCKER to your watchlist — Pro pings you within 5 minutes of any new MYDATA / ALPHA LOCKER leak-site post, Telegram callout, or affiliate-rebrand inference.