Knoll Listed by ALPHV Ransomware Group

On October 6, 2022, design firm Knoll, a subsidiary of MillerKnoll, Inc., appeared on the leak site of the alphv ransomware group. The listing states that internal files were exfiltrated during a ransomware attack. The company, known for office systems, seating, tables, textiles, and licensed furniture from designers including Ludwig Mies van der Rohe and Florence Knoll, has not publicly quantified how many individuals or records may be affected.

Details from the Leak Site

The alphv leak site listing, still accessible via the onion address http://alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion/3f2d42ac-22be-4879-b1de-4eba2c7a4e11 as mirrored on ransomware.live, claims that Knoll suffered a ransomware intrusion and that attackers successfully removed internal files. The disclosure does not specify the volume or exact nature of the data taken, nor does it list sample records or set an explicit publication deadline in the initial posting. Public reporting on alphv indicates the group often uses such listings to pressure victims into payment after initial encryption and data theft.

Why This Matters for You and Your Family

When a company like Knoll that serves both commercial and residential customers is breached, the fallout can reach ordinary people. Employees, recent customers, design professionals, educators, and anyone who interacted with Knoll’s systems may have personal information entangled in the stolen files. Even if the leak site does not publish every record, the mere confirmation that internal files left the network creates long-term risk. Your name, address, phone number, email, order history, or payment details could be exposed without your knowledge, increasing chances of identity theft, phishing, or unwanted solicitations aimed at you or members of your household.

The Doxxing and Identity-Chain Risks

Stolen internal files frequently contain spreadsheets, customer databases, employee rosters, or vendor contacts that link names to addresses, emails, and sometimes dates of birth. Once such data reaches criminal forums, it becomes raw material for doxxing chains. Attackers combine it with information from other breaches to map your online handles back to your real-world identity. This is especially dangerous for families because children’s school records, extracurricular sign-ups, or even gaming accounts can be tied to the same household address or parent email. Credential leaks of this type often cascade into account takeovers on gaming platforms, where stolen logins are tested across Steam, Roblox, Epic, and others.

Alphv’s Known Track Record

Public reporting attributes the emergence of alphv, also known as BlackCat, to mid-2021. The group has targeted organizations across healthcare, manufacturing, education, and professional services. Notable prior victims include large corporations whose data appeared on the same leak site with similar claims of exfiltrated files. Alphv typically gains initial access through compromised credentials or vulnerable remote desktop services, exfiltrates data before deploying ransomware, and then uses a double-extortion model: threatening both system encryption and public release of stolen documents unless payment is made. The group’s leak site serves as both a shaming platform and a marketplace for unsold data.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup of exposed records by Warden specialists.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught in hours rather than months.
• Rotate any password you used on Knoll-related accounts or services and replace it with a unique passphrase, then enable 2FA through an authenticator app rather than SMS.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same address or parent credentials in breaches like this.
• Let remediation specialists handle ongoing takedown requests for any personal data appearing on broker sites or forums that surface from this incident.

The Knoll listing is a reminder that even well-known design brands handling everyday customer and employee information remain targets. A single ransomware event can quietly feed identity thieves for years. Starting with DoxxScan gives you continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes children’s gaming accounts. Source: alphv leak site (via ransomware.live)