Corsica-Ferries Listed by alphv Ransomware Group

On October 27, 2023, ferry operator Corsica Ferries appeared on the leak site of the Alphv ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the Franco-Italian company, which carries more than 2.8 million passengers each year between France, Italy, Corsica, Sardinia, and Elba. The number of people whose data may be exposed remains unknown.

Details in the Leak-Site Listing

The Alphv leak page, still accessible via its onion address as of the initial publication, claims that Corsica Ferries suffered a ransomware intrusion and that attackers successfully removed internal files. The disclosure does not quantify the volume of data taken, list specific record counts, or itemize the exact document types. It simply states that internal files were exfiltrated and gives the company until a set deadline to negotiate before further publication. No customer booking records, passport details, or payment information are explicitly confirmed in the listing itself.

Why This Matters for You and Your Family

If you have traveled with Corsica Ferries, Sardinia Ferries, or Elba Ferries in recent years, your personal information may sit inside the stolen material. Ferry bookings routinely capture full names, home addresses, phone numbers, email addresses, dates of birth, and sometimes passport or identity-card numbers. When such details leave a travel company’s network, they become raw material for identity theft, phishing campaigns, and long-term fraud against you and every member of your household. Even without an exact victim count, the breach represents a high-severity exposure for anyone who has used the service.

The Doxxing and Identity-Chain Risks

Travel records frequently link real-world identity to email addresses, phone numbers, and booking references. Once attackers possess those connections, they can chain them with data from other breaches to build detailed profiles. A seemingly harmless ferry booking can reveal your home port, travel companions, and children’s names. These threads often extend into gaming accounts that reuse the same email or password, turning one corporate breach into repeated account takeovers across your family’s digital life. The longer the data circulates on dark-web forums, the higher the chance it will be packaged and sold for targeted scams or doxxing.

Alphv’s Known Track Record

Public reporting attributes the Alphv group, also known as BlackCat, with emerging in late 2021. The gang has since claimed responsibility for attacks on dozens of organizations across healthcare, manufacturing, logistics, and travel. Their typical playbook begins with initial access gained through compromised credentials or remote desktop exploits, followed by rapid lateral movement, data exfiltration, and deployment of custom ransomware. After encryption, they shift to extortion, threatening to publish stolen files on their leak site if payment is not received. The Corsica Ferries listing follows this exact pattern: exfiltration confirmed, followed by a public countdown.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Rotate any password you used on the Corsica Ferries website or app wherever it has been reused, and switch on 2FA through an authenticator app instead of SMS.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same address or parent email.
• Let remediation specialists manage takedown requests for any exposed personal documents or broker listings that surface from this incident.

The incident underscores that travel companies remain attractive targets because passenger data travels with you long after the voyage ends. Starting proactive defense now limits how far attackers can extend the identity chain created by the Alphv breach. DoxxScan by GalaxyWarden delivers that defense through continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts vulnerable to credential-stuffing attacks that often follow leaks like this one.