Was groupg4.com hit by ransomware?

groupg4.com was listed by the Redalert ransomware operation, and stolen data was published on the group's leak site. Darkfield tracks this disclosure with the original leak post, screenshot and group context.

Who is the Redalert ransomware group?

Redalert is a ransomware operator tracked by Darkfield. See the full operator dossier for its known victims, sectors targeted, IOCs and leak-site infrastructure.

What data was leaked in the groupg4.com breach?

Redalert published data attributed to groupg4.com. Darkfield captured the leak post and a screenshot of the listing.

Ransomware victim disclosure

← All victims

G4 Group Arquitectura, Ingeniería y Diseño

listed as groupg4.com · Claimed by Redalert · listed 4 years ago

46m

Age

since listed · data leaked

Status timeline

ListedSep 13, 2022
Data leakeddate unknown

At a glance

Group: Redalert
Status: Data leaked
Sector: Business Services
Listed on leak site: Sep 13, 2022

About the victim

AI dossier — public-source company profile

G4 Group is a multidisciplinary architecture, engineering and design studio headquartered in Barcelona, Spain, with additional offices in Madrid, Turin, Paris, and Dubai. Founded in 2001, the firm offers services spanning architecture, technical architecture, project management, BIM services, lighting design, and 3D visualisation. The studio has over 25 years of international project experience, with notable clients including Louis Vuitton and projects in locations such as Dubai and Vienna.

Industry: Architecture, Engineering & Design
Address: Barcelona, Spain (also offices in Madrid, Turin, Paris, and Dubai)
Founded: 2001

Attack summary

Severity: medium — Data is marked as published, suggesting confirmed exfiltration; however, no details on data type, volume, or sensitivity were captured, and the victim is a mid-sized professional services firm rather than critical infrastructure or a handler of regulated personal data at scale.

Redalert claims to have attacked groupg4.com and the disclosure status is marked as data_published, indicating data has been released; however, no leak post details, ransom demand, or specific data volume were captured to confirm the nature or scope of the exfiltration.

medium

Sources

Victim sitegroupg4.com

Source

Indexed 4 years ago

This page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.

Is this your supplier? Your competitor? You?

Pro plans monitor your domain, corporate emails, and crypto wallets across every new ransomware leak-site post, breach dump and Telegram callout — alerts within 5 minutes.

Disclosure context

About Redalert

Redalert is a relatively obscure ransomware group that emerged in July 2022 with primarily financial motivations, operating on a smaller scale compared to major ransomware families. The group's origin and potential affiliations remain largely undocumented in public threat intelligence reporting, with limited information available from major security organizations regarding their operational structure or whether they operate as a Ransomware-as-a-Service model. Based on available data, Redalert has demonstrated a geographic focus on Western European targets, particularly concentrating their operations against entities in the United Kingdom and France, though their specific attack methodologies, initial access vectors, and technical capabilities have not been extensively documented in public security research. With only six known victims since their emergence, the group represents a minor player in the ransomware ecosystem, and their limited operational footprint suggests they may lack the sophistication and resources of more prominent ransomware operations. Current intelligence indicates minimal ongoing activity from this group, though definitive information about their operational status, potential disruption, or dissolution is not available in public reporting from major cybersecurity organizations. The group has been linked to 6 public disclosures across our corpus. First observed on a leak site on July 14, 2022; most recent post September 22, 2022. The operation is currently inactive.

Also tracked as: Red Alert.

Timeline of this disclosure

September 13, 2022groupg4.com listed by Redalerton the group's public leak site

Other recent disclosures by Redalert

Redalert has been linked to 6 public victims on Darkfield. A sample of the most recent:

See the full Redalert dossier →

Sector and geography

This disclosure adds to ransomware activity in the Business Services sector, which has 3,796 disclosures indexed across all operators we track.

If your organisation is affected

A listing by Redalert means groupg4.com appeared on a ransomware extortion site and data attributed to it has been published. If this is your organisation, or a supplier you depend on, the priority is to confirm the intrusion and contain it before the window to act closes.

Engage your incident-response team and preserve forensic evidence before remediating — do not wipe affected systems first.
Force a password reset and revoke active sessions for exposed accounts; rotate any credentials, API keys or certificates that may have been in the stolen data.
Assess regulatory notification duties (GDPR, NIS2, sector regulators) — many carry a 72-hour reporting clock from awareness.
Monitor for the data appearing on Redalert's leak site and across paste and breach channels, and brief downstream partners who may be exposed through you.

How we know this. Darkfield monitors public ransomware leak sites continuously, archiving every new disclosure and the data later released against the victim. Each entry on this page is sourced from the operator's own publication and cross-checked against complementary OSINT feeds (RansomLook, ransomware.live, RansomWatch). We do not collect or host stolen data — only the metadata, timestamps and screenshots needed to make the public disclosure searchable and accountable. Records here are corrected when the original post is edited, retracted, or merged with another disclosure.