Ransomware victim disclosure
← All victimsKOB 4 Eyewitness News
listed as kob.com · Claimed by ALP-001 · listed 2 months ago
Status timeline
- Listed
Mar 29, 2026
- Ransom deadline
Apr 2, 2026
- Data leaked
At a glance
- Group
- ALP-001
- Status
- Data leaked
- Country
- United States
- Sector
- Not Found
- Listed on leak site
- Mar 29, 2026
- Ransom deadline
- Apr 2, 2026
- Data size
- 1.127 TB
- Ransom demanded
- $22M
- Estimated revenue
- $22M
About the victim
AI dossier — public-source company profileKOB 4 Eyewitness News (KOB.com) is a television news station serving Albuquerque, Santa Fe, and the broader New Mexico region. It provides local news, weather, sports, and investigative journalism under the 'Eyewitness News 4' brand. The station is one of the primary broadcast news outlets in New Mexico.
- Industry
- Broadcast Television News
- Address
- Albuquerque, New Mexico, United States
Attack summary
Severity: high — 1.127 TB of data has been claimed as exfiltrated and the status is data_published, indicating significant business data exposure from a regional media organization. While not a healthcare or government target, the scale of exfiltration and publication of data warrants a high severity rating.The ALP-001 ransomware group claims to have exfiltrated approximately 1.127 TB of data from KOB 4 Eyewitness News, with the disclosure status listed as data_published, suggesting the stolen data has been or is being released. The group has set a deadline of April 2, 2026, and references $22M, likely the stated ransom demand.
Data the group says was taken
AI dossier — extracted from the leak post- Internal broadcast/newsroom files
- Business and operational data
- Employee records
- Potentially sensitive investigative journalism materials
What the group claims
Country: USA Revenue: $22 Million Storage: 1.127TB Description: KON (KOB 4, Eyewitness News 4 is your best source for Albuquerque news, Santa Fe news and New Mexico news, weather and sports. Deadline: 2026-04-02 23:23:40
Sources
Source
Indexed 2 months agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
