kob.com Listed by ALP-001 Ransomware Group

On March 29, 2026, television station KOB.com appeared on the leak site of the ransomware group ALP-001. The New Mexico broadcaster, which serves Albuquerque, Santa Fe and surrounding communities, had 1.127 terabytes of internal files exfiltrated after a ransomware attack. The group set a public deadline of April 2, 2026, at 23:23:40 for the company to respond or face publication of the stolen data.

What's Publicly Reported from Reporting

Public reporting on the ALP-001 leak site lists KOB.com, also known as KOB 4 and Eyewitness News 4, as the latest victim. The station generates roughly $22 million in annual revenue and is based in the United States. Available reporting describes the stolen material as internal files totaling 1.127TB. No confirmed list of exposed employee or customer records has surfaced yet, but the volume suggests the data could include documents that contain personal information.

The incident follows the group’s standard pattern of encrypting systems, exfiltrating data before encryption completes, and then pressuring the victim by threatening to release the files. As of the publication of this article, it remains unclear whether KOB.com paid any ransom or whether ALP-001 has begun releasing samples.

Why This Matters for You and Your Family

When a local news station is breached, the information it holds often reaches far beyond the newsroom. Employee records, contributor databases, advertising client details, and tip-line submissions can contain names, addresses, phone numbers, email accounts and dates of birth. If any of those records belong to you or someone in your household, the breach puts your family at immediate risk of identity theft, phishing campaigns and unwanted solicitations.

Even if you never directly interacted with KOB.com, credential reuse means a password exposed in one breach can unlock accounts elsewhere. Local news outlets frequently store information about community members who appear in stories, submit photos, or register for station events. That data, once loose, travels quickly through underground networks.

The Doxxing and Identity-Chain Implications

Ransomware leaks rarely stop at the first dataset. Criminals use stolen internal files to map relationships between email addresses, usernames, phone numbers and physical addresses. These links create identity chains that allow attackers to locate additional accounts, including social media profiles, online shopping accounts and gaming logins. A single exposed work email from this incident can therefore expose far more than the original breach suggests.

Credential leaks like this one cascade into account takeovers and doxxing chains. Children’s gaming accounts are especially vulnerable because kids often reuse simple passwords or email addresses tied to family domains. Once an attacker controls one account, they can pivot to others using the same credentials, gradually building a complete profile of your household.

ALP-001’s Publicly Known Track Record

Public reporting attributes the ALP-001 ransomware group with activity that emerged in late 2024. The group has targeted mid-sized organizations across the United States, focusing on companies with revenue between $10 million and $50 million. Notable prior victims include regional manufacturers, healthcare providers and local media outlets. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by rapid exfiltration of documents and databases. ALP-001 then uses dual extortion: threatening both data publication and, in some cases, claims of regulatory violations. The group posts countdown timers on its leak site and occasionally releases small samples to increase pressure.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames and real-world identity so you can see exactly what this claimed breach may have exposed about your household.
• Rotate any password you used at KOB.com or any related company account, then enable two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next leak that touches your family is caught within hours instead of months.
• Cover the entire household with DoxxScan family protection, which includes children’s gaming accounts that often chain back to the same addresses and parent emails exposed in incidents like this.
• Let remediation specialists handle takedown requests across data brokers and suspicious sites where your information may already be appearing.

The KOB.com breach illustrates how quickly local institutions can become gateways to personal exposure for thousands of ordinary families. Taking concrete steps now limits how far attackers can travel down the identity chain created by this and future leaks. DoxxScan by GalaxyWarden delivers that protection through continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that explicitly includes children’s gaming accounts.