alloha.com Listed by thegentlemen Ransomware Group

On April 4, 2026, Brazilian fiber-optic provider Alloha appeared on the leak site of the ransomware group known as thegentlemen. The company, which serves 1.5 million customers across 280 cities with a network spanning more than 140,000 km of optical fiber, is claimed to have had internal files exfiltrated during a ransomware attack.

What Public Reporting Shows

Available reporting describes the incident as a ransomware deployment that resulted in data exfiltration. Thegentlemen posted a listing for alloha.com on their leak site, referencing internal documents. Alloha, founded in 2018 and headquartered in Sao Paulo, is the largest independent FTTH operator in Brazil. Public reporting indicates that the precise number of affected individuals remains unknown, and the exact types of customer records exposed have not been fully detailed in available sources. The listing appeared on April 4, 2026, consistent with the group’s typical practice of publishing victim data after failed ransom negotiations.

Why This Matters for You and Your Family

If you or anyone in your household uses Alloha internet service, your personal information may now sit in a ransomware leak repository. That data can include names, addresses, contact details, and account records tied to your home internet connection. Once exposed, these details become building blocks for identity theft, phishing campaigns, and unwanted solicitations. Your family’s daily reliance on home internet means a breach at your provider touches every device and every online activity linked to your address. Even when victim counts are listed as unknown, the scale of a company serving 1.5 million customers makes it likely that thousands of ordinary families are now at higher risk.

The Doxxing and Identity-Chain Implications

Ransomware leaks rarely stop at one dataset. Criminals combine the newly released Alloha files with information from earlier breaches to create detailed profiles. An email address found in this leak can be matched to gaming accounts, social-media handles, or school records. This identity-chain process turns a single provider breach into long-term exposure. Public reporting shows that credential leaks like this one frequently cascade into account takeovers, especially for gaming platforms used by children. When a child’s gaming username is linked back to a parent’s leaked home address, the entire household becomes an easier target for harassment, swatting, or financial fraud.

Thegentlemen’s Publicly Known Track Record

Public reporting attributes thegentlemen with emerging in late 2024 as a ransomware operation that combines double-extortion tactics with selective data leaks. The group has claimed responsibility for attacks on mid-sized companies across multiple countries, often targeting organizations with large customer bases in telecommunications, healthcare, and local government. Their typical playbook involves initial access through compromised credentials or remote desktop vulnerabilities, followed by exfiltration of internal files and deployment of ransomware. After encryption, they demand payment and threaten to publish stolen data on their leak site if the deadline passes. Industry trackers note that thegentlemen maintain a relatively low public profile compared with larger ransomware families but consistently follow through on publishing samples when victims do not pay.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, addresses, and online handles that may have surfaced in this breach.
• Rotate any password you used with Alloha anywhere it is reused, and switch on two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours instead of months.
• Cover the household with DoxxScan family protection that includes dependents and your children’s gaming accounts, which often chain back to the same home address and become targets after provider leaks.
• Let DoxxScan remediation specialists handle takedown requests for any personal records that appear on data-broker sites or public forums.

The Alloha breach is a reminder that even essential home services can expose your family to cascading risks once their data leaves secure systems. Acting quickly on credential hygiene and identity mapping limits how far criminals can travel down the chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that explicitly protects children’s gaming accounts. Starting your DoxxScan trial gives you and your family the visibility and support needed to close off the paths attackers rely on.