lacor.es Listed by ALP-001 Ransomware Group

On March 29, 2026, the Spanish company lacor.es appeared on the leak site of the ransomware group ALP-001. The listing includes 182.71 GB of internal files that attackers say they exfiltrated during a ransomware incident. The group set a public deadline of April 8, 2026 and posted a mocking note about wanting “some fun” with the small company’s data.

What Public Reporting Shows

Public reporting on the ALP-001 leak site describes lacor.es as a Spanish entity with roughly $9 million in revenue. The posted data consists of internal files rather than a structured database of customer records. No exact number of individuals affected has been released. The sample files shown on the leak page have not been independently verified by third parties, but the incident follows the group’s standard pattern of publishing stolen material when ransom demands go unmet.

Why This Matters for You and Your Family

Even when a breach targets a business, the files often contain documents that name suppliers, partners, employees, or customers. If your personal or family information appears in contracts, invoices, HR records, or email correspondence, it can surface in follow-on attacks. Credential leaks from such incidents frequently cascade into account takeovers on personal email, banking, and social media. Children’s names, school details, or family addresses sometimes sit inside the same folders, giving attackers easy starting points for harassment or identity theft aimed at your household.

The Doxxing and Identity-Chain Risks

Stolen internal files can link usernames, email addresses, phone numbers, and real-world identities in ways that are not obvious at first glance. Attackers chain these fragments across dozens of platforms to build full profiles. A single exposed work email can lead to personal accounts, and from there to gaming logins or family photos. Once the chain exists, doxxing escalates quickly—harassment, swatting, or extortion become realistic threats. Credential reuse across work and home systems makes the jump from corporate breach to personal compromise almost automatic.

ALP-001’s Publicly Known Track Record

Public reporting attributes ALP-001 with emerging in late 2024. The group has listed small-to-medium businesses across Europe and Latin America, typically targeting organizations with limited security staff. Its playbook involves initial access through phishing or remote desktop vulnerabilities, followed by claimed exfiltration of internal shares and file servers. Extortion follows a dual strategy: pressure the victim privately, then publish samples on its leak site with a short deadline if payment is refused. ALP-001 often chooses lightly defended targets and uses mocking language in its posts, consistent with the lacor.es listing.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Rotate any password you used at lacor.es or related services anywhere it is reused, and switch on 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught in hours, not months.
• Cover the household—DoxxScan family coverage extends to dependents and children’s gaming accounts that often chain back to the same addresses and credentials.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing your own accounts.

The lacor.es incident shows that even small-company data leaks can reach ordinary families through indirect chains of personal information. Acting quickly on exposed credentials and hidden linkages limits the damage. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects handles to real identities, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Starting your DoxxScan trial today gives you both immediate visibility into your exposure and expert help closing the gaps attackers rely on.