Ransomware victim disclosure
← All victimsTelewizja Polsat
listed as polsat.pl · Claimed by ALP-001 · listed 2 months ago
Status timeline
- Listed
Mar 29, 2026
- Ransom deadline
Apr 8, 2026
- Data leaked
At a glance
- Group
- ALP-001
- Status
- Data leaked
- Country
- Poland
- Sector
- Telecommunication
- Listed on leak site
- Mar 29, 2026
- Ransom deadline
- Apr 8, 2026
- Data size
- 75.71 GB
- Ransom demanded
- $148.5M
- Estimated revenue
- $148.5M
About the victim
AI dossier — public-source company profileTelewizja Polsat (polsat.pl) is Poland's first independent commercial television station, founded in 1992. It operates a broad portfolio of TV channels targeting general audiences, with programming built around its own productions and a wide selection of feature films. Polsat is one of the largest and most recognisable media groups in Poland.
- Industry
- Broadcast Television & Media
- Founded
- 1992
Attack summary
Severity: high — 75.71 GB of data has been reportedly exfiltrated and published from a major national broadcaster, constituting confirmed exfiltration of significant business data at scale; while the specific content is unspecified, the volume and the disclosed status ('data_published') warrant a high severity rating.The group ALP-001 claims to have exfiltrated approximately 75.71 GB of data from Polsat and has published the data, with a deadline of 8 April 2026. The ransom demand associated with the attack is stated as $148.5 million.
Data the group says was taken
AI dossier — extracted from the leak post- Internal company files
- Business documents
- Potentially broadcast/production data
What the group claims
Country: Poland Revenue: $148.5 Million Storage: 75.71 GB Description: Polsat is t he first independent TV station in Poland. The main objective of Polsat is to meet the varied tastes of the general public. The program offer is built primarily on the basis of its own brand productions combined with the interesting portfolio of feature films. Deadline: 2026-04-08 00:27:18
Sources
Source
Indexed 2 months agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
