Saville Row - Grupo GTD was hacked A huge amount of personal information was stolen Listed by alphv Ransomware Group

On April 21, 2023, Chilean companies Saville Row and its parent Grupo GTD appeared on the leak site of the Alphv ransomware group. The listing states that a large volume of internal files containing personal information was exfiltrated during a ransomware attack. The disclosure does not quantify the number of affected individuals or specify the exact data fields involved.

Details from the Leak-Site Listing

The primary disclosure on the Alphv onion site, archived via ransomware.live, claims that attackers gained access to Grupo GTD’s systems and stole internal documents. Saville Row, a Chilean apparel retailer headquartered in Colina, Santiago, and Grupo GTD, a major Chilean telecommunications and IT services provider with roughly $1 billion in revenue, are both named. The listing does not detail what specific categories of personal information were taken, nor does it provide sample files or a ransom demand amount. It simply asserts that a huge amount of personal information was stolen and threatens further publication if demands are not met.

Why This Matters for You and Your Family

When a telecommunications provider like Grupo GTD suffers a breach, the ripple effects reach ordinary customers, employees, and their households. Billing records, service contracts, contact details, and potentially scanned identification documents can expose names, addresses, national identification numbers, phone numbers, and email accounts. Internal files exfiltrated in such incidents often contain exactly the building blocks attackers need to impersonate you with banks, government agencies, or retailers. For families in Chile this means heightened risk of account takeovers, fraudulent loan applications in your name, or targeted phishing campaigns that reference real service history. Even if you are not a direct customer, shared vendors or employee data can still place your information in the same dataset.

The Doxxing and Identity-Chain Risks

Stolen internal files rarely stay isolated. Once names and contact details surface on a ransomware leak site, other criminals scrape them and begin linking them to usernames, gaming handles, and social-media profiles. A single leaked phone number or national ID can connect your work email to a child’s Roblox or Minecraft account, especially when family members share devices or reuse passwords. These identity chains accelerate doxxing: attackers can map your full household, locate exact addresses, and escalate from credential theft to SIM-swapping or physical intimidation. Credential leaks like this one frequently cascade into gaming account takeovers that expose chat logs, payment methods, and additional personal details, further enriching the attacker’s profile of your family.

Alphv’s Publicly Known Track Record

Public reporting attributes the Alphv group, also known as BlackCat, with emerging in late 2021. The gang has since hit hospitals, municipalities, and mid-sized companies across North and South America. Their typical playbook involves initial access through compromised remote desktop credentials or phishing, followed by rapid lateral movement inside corporate networks, exfiltration of sensitive files, and then dual extortion: demanding ransom for decryption and a second payment to prevent data publication. The April 2023 listing of Saville Row and Grupo GTD fits this pattern. Alphv frequently uses data leak sites on both clearnet mirrors and Tor to pressure victims, and they have demonstrated willingness to release initial batches of stolen data when negotiations stall.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, national ID, and online handles so you can see exactly what chains back to this claimed breach.
• Rotate any password you used at Saville Row, Grupo GTD, or their affiliated services, then enable 2FA with an authenticator app everywhere that same password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught and acted on within hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become the next link in doxxing chains after a parent’s data appears on leak sites.
• Let remediation specialists handle takedown requests and broker opt-outs for you instead of attempting manual removal across dozens of data marketplaces.

The incident underscores that even regional service providers can become high-value targets whose stolen files directly threaten ordinary families. Starting now with concrete steps to map and lock down your identity chains is the most practical defense. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts at risk from cascading credential leaks.