Simex Defence Inc Listed by ALPHV Ransomware Group

On October 1, 2022, Canadian defence contractor Simex Defence Inc appeared on the leak site of the Alphv ransomware group. The listing states that internal files were exfiltrated during a ransomware attack. The company, which supplies military parts and manages complex manufacturing for aerospace, land, and marine programmes, has not publicly quantified how many records were taken or which specific systems were compromised.

Primary Disclosure Details

The Alphv leak site entry states that Simex Defence suffered a ransomware intrusion in which attackers successfully exfiltrated internal files. No exact volume of data or list of exposed record types is published on the site. The disclosure indicates the files were taken prior to the public listing and that the company faces an implied extortion deadline typical of the group’s playbook. Public reporting on Alphv shows the actor routinely posts proof-of-compromise samples and threatens full data release if payment is not made.

Why This Matters for You and Your Family

Even when a breach hits a defence supplier rather than a consumer website, the consequences reach ordinary people. Simex Defence maintains extensive supplier databases, partner lists, and procurement records that can contain names, addresses, contact details, and financial information of employees, vendors, and subcontractors. If any of those records include your data, it may now be in the hands of professional extortionists. Internal files exfiltrated in such attacks frequently include spreadsheets, contracts, and email archives that reveal personal identifiers far beyond a simple password list.

Doxxing and Identity-Chain Risks

Once internal files leave a company network they rarely stay contained. Attackers or subsequent buyers can cross-reference names, emails, and phone numbers against other leaks, creating long-term identity chains. A supplier email from Simex Defence combined with a reused password from an earlier breach can lead to account takeovers on personal services, government portals, or even children’s gaming accounts that share the same household address or recovery details. These chains accelerate doxxing because one exposed work relationship can expose home addresses, family member names, and linked online handles.

Alphv Group Track Record

Public reporting attributes the emergence of Alphv (also known as BlackCat) to late 2021. The group has since hit hospitals, manufacturers, and technology firms across North America and Europe. Notable prior victims include large retailers and healthcare providers whose data appeared on the same leak infrastructure now listing Simex Defence. Their typical playbook begins with initial access through compromised credentials or vulnerable remote desktop services, followed by rapid exfiltration of sensitive folders before encryption. Extortion then proceeds in two stages: first demanding ransom to prevent publication, then threatening to sell or auction the data on dark-web marketplaces if the victim refuses. The leak site itself is designed to pressure both the victim and any third parties whose information appears in the stolen files.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity drawn from this and earlier exposures.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your data surfaces you learn within hours rather than months.
• Rotate any password you used at Simex Defence or any of its partner portals anywhere else it is reused, and switch to 2FA through an authenticator app instead of SMS.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same address or recovery email exposed in supplier records.
• Let remediation specialists handle takedown requests across data brokers and extortion-related sites on your behalf.

The incident underscores that defence-industry supply chains are now routine targets and that your personal data can be swept up even if you never directly interacted with the breached company. Starting proactive steps today limits how far any single leak can travel. DoxxScan by GalaxyWarden provides continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts vulnerable to credential-based takeovers.