Was Spectrum Solutions LLC hit by ransomware?

Spectrum Solutions LLC was listed by the alphv ransomware operation, and stolen data was published on the group's leak site. Darkfield tracks this disclosure with the original leak post, screenshot and group context.

Who is the alphv ransomware group?

alphv is a ransomware operator tracked by Darkfield. See the full operator dossier for its known victims, sectors targeted, IOCs and leak-site infrastructure.

What data was leaked in the Spectrum Solutions LLC breach?

alphv published data attributed to Spectrum Solutions LLC. Darkfield captured the leak post and a screenshot of the listing.

Ransomware victim disclosure

← All victims

Spectrum Solutions LLC

Claimed by Alphv · listed 3 years ago

32m

Age

since listed · data leaked

Status timeline

ListedNov 24, 2023
Data leakeddate unknown

At a glance

Group: Alphv
Status: Data leaked
Sector: Consumer Services
Listed on leak site: Nov 24, 2023

About the victim

AI dossier — public-source company profile

Spectrum Solutions LLC is a medical device engineering and contract manufacturing company founded in 2006, specializing in innovative diagnostic solutions. The company is particularly known for pioneering saliva-based COVID-19 testing and holds FDA Emergency Use Authorization for its SDNA-1000 saliva collection device. They provide contract manufacturing, product development, and diagnostic assay licensing services to the life sciences sector.

Industry: Medical Device Manufacturing & Contract Manufacturing
Founded: 2006

Attack summary

Severity: medium — Medical device manufacturer with sensitive business operations (FDA-authorized products, contract manufacturing details, research programs) appears compromised. No specific PII at scale, regulated health data, or financial records are explicitly mentioned as published, but the company handles regulated medical devices and likely possesses customer/patient data from diagnostics operations. The disclosed content is marketing material only.

ALPHV claims to have exfiltrated data from Spectrum Solutions. The group has published the company's own marketing content describing their operations, products, and innovations in medical devices and diagnostics.

medium

Data the group says was taken

AI dossier — extracted from the leak post

Company marketing materials
Product information
Business descriptions

What the group claims

Our Story Since 2006, Spectrum Solutions has been a single-source provider of high-quality, direct-to-consumer product innovation & global fulfillment. For the last decade, Spectrum has found a specialized focus in the medical science sector that includes the engineering and manufacturing of industry innovating medical devices. Spectrum’s innovation has made such an impact within the life science sector it has been honored with several prestigious awards, received incredible industry and private sector recognition, and is directly responsible for the birth of a new billion-dollar saliva diagnostic industry. We engineer and have medical device contract manufacturing, actively participate in medical science research programs, develop, and license diagnostic testing assays, we are uniquely able to offer our contract manufacturing and MedTech outsourcing customers measurable process optimization, a shorter time to market window, unmatched scalability, and full product development-to-delivery solutions. Sometimes a fresh perspective on something we thought we understood, can open the door of new possibilities we hadn’t even considered. Focused on pioneering medical device innovation, Spectrum Solutions commissioned the breakthrough saliva study that dared to suggest a complete transformation in viral PCR testing protocols to an easier, pain-free, non-invasive, 99.998% accurate, and infinitely safer option using saliva (spit). Saliva’s recent MVP status is a new development even though saliva’s been used in diagnostics for more than 2000 years. Analysis of the properties in saliva using biochemical and physiological methodologies are traced back to at least a century ago. Unlike blood, saliva analysis looks at the cellular level (the biologically active compounds), making it a better representative of what is clinically relevant. Years from now, the medical community, patients, and history books will look back on 2020 and COVID-19 testing as the diagnostic turning point in favor of saliva. In affirmation of this diagnostic innovation pivot, a speedy and unprecedented FDA response secured the first Emergency Use Authorization (EUA) early March 2020, for the use of saliva, solely collected using the Spectrum SDNA-1000, as a diagnostic biomaterial for COVID-19 testing. A few weeks later, requests for additional product and process information to further validate safety and sample efficacy in extended storage and transport scenarios. The device’s remarkable performance locked in the FDA’s first direct-to-patient at-home testing authorization for the self-collection of saliva. A timely decision that drove product integration both nationwide and globally. Saliva collected using a Spectrum bio-sample collection system creates the most robust and safest testing biomaterial. We believe when you bridge the gap between science and real medical solutions you deliver innovation with the practical power to impact and change outcomes. Our products, services, and expertise are paving the way and pioneering a new era of direct-to-consumer health & wellness, point-of-care, and at-home molecular diagnostic testing.

Sources

Source

Indexed 3 years ago

This page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.

Is this your supplier? Your competitor? You?

Pro plans monitor your domain, corporate emails, and crypto wallets across every new ransomware leak-site post, breach dump and Telegram callout — alerts within 5 minutes.

Disclosure context

About alphv

ALPHV, also known as BlackCat or Noberus, is a financially motivated ransomware group that emerged in September 2021 and rapidly established itself as one of the most sophisticated and prolific ransomware operations observed by researchers at Mandiant, CISA, and the FBI. The group is suspected to have Russian-speaking origins and operates as a Ransomware-as-a-Service (RaaS) platform, with well-documented links to former affiliates of the DarkSide and BlackMatter ransomware operations, suggesting a continuity of personnel and tradecraft across these successive rebrand events. ALPHV is technically distinguished by its use of Rust-based ransomware — an uncommon choice at the time of its emergence — which enabled cross-platform attacks against Windows, Linux, and VMware ESXi environments; the group employs multiple initial access vectors including compromised credentials, phishing, and exploitation of unpatched vulnerabilities, and routinely conducts double and triple extortion by exfiltrating sensitive data prior to encryption and threatening victims with public disclosure on their dedicated leak site, with some cases involving additional pressure through direct contact with victim customers and regulators. ALPHV has claimed responsibility for high-profile attacks against MGM Resorts International, Caesars Entertainment, Reddit, and healthcare provider Change Healthcare — the latter representing one of the most disruptive cyberattacks on the U.S. healthcare sector on record, with a reported ransom payment of approximately $22 million — and has accumulated over 731 known victims across the United States, Canada, Australia, the United Kingdom, and Germany, with particular concentration in business services, manufacturing, healthcare, technology, and financial services sectors. In December 2023, the FBI and international partners conducted a disruption operation against ALPHV's infrastructure and released a decryption tool for victims; however, the group subsequently attempted to rebrand and continued operations before an apparent final collapse in March 2024, following an alleged exit scam against affiliates after the Change Healthcare ransom payment, with law enforcement officially attributing the group's infrastructure seizure shortly thereafter. The group has been linked to 731 public disclosures across our corpus. First observed on a leak site on September 9, 2021; most recent post March 3, 2024. The operation is currently inactive.

Also tracked as: BlackCat, Noberus.

Timeline of this disclosure

November 24, 2023Spectrum Solutions LLC listed by alphvon the group's public leak site

Other recent disclosures by alphv

alphv has been linked to 731 public victims on Darkfield. A sample of the most recent:

See the full alphv dossier →

Sector and geography

This disclosure adds to ransomware activity in the Consumer Services sector, which has 829 disclosures indexed across all operators we track.

If your organisation is affected

A listing by alphv means Spectrum Solutions LLC appeared on a ransomware extortion site and data attributed to it has been published. If this is your organisation, or a supplier you depend on, the priority is to confirm the intrusion and contain it before the window to act closes.

Engage your incident-response team and preserve forensic evidence before remediating — do not wipe affected systems first.
Force a password reset and revoke active sessions for exposed accounts; rotate any credentials, API keys or certificates that may have been in the stolen data.
Assess regulatory notification duties (GDPR, NIS2, sector regulators) — many carry a 72-hour reporting clock from awareness.
Monitor for the data appearing on alphv's leak site and across paste and breach channels, and brief downstream partners who may be exposed through you.

How we know this. Darkfield monitors public ransomware leak sites continuously, archiving every new disclosure and the data later released against the victim. Each entry on this page is sourced from the operator's own publication and cross-checked against complementary OSINT feeds (RansomLook, ransomware.live, RansomWatch). We do not collect or host stolen data — only the metadata, timestamps and screenshots needed to make the public disclosure searchable and accountable. Records here are corrected when the original post is edited, retracted, or merged with another disclosure.