SolarCraft Listed by alphv Ransomware Group

On September 22, 2022, solar energy company SolarCraft was listed on the leak site of the alphv ransomware group. The North Bay-based provider of solar and clean energy solutions, which has operated for more than 35 years and is 100% employee-owned, is claimed to have had internal files exfiltrated during a ransomware attack. The listing does not specify the number of records affected or detail exactly which documents were taken.

Reported Details from the Listing

The alphv leak site entry states that SolarCraft suffered a ransomware incident in which attackers successfully exfiltrated internal files. No victim count is provided, and the disclosure does not quantify the volume or specific categories of data involved. The listing appeared on the group’s onion site, with the primary public mirror tracked at ransomware.live. As is typical with these extortion platforms, the actors threaten to publish the stolen material unless their demands are met, though the exact ransom figure remains unknown to the public.

Internal files exfiltrated is the only description given. This lack of granularity is common in initial ransomware listings; the group often releases sample files later to increase pressure.

Why This Matters for You and Your Family

When a local business like SolarCraft is breached, anyone who has ever been a customer, employee, vendor, or partner may have personal information at risk. Solar installers, energy consultants, and administrative staff routinely handle names, addresses, phone numbers, email addresses, dates of birth, Social Security numbers, banking details for rebates, and tax documentation. Even if the leak site does not list every data type, the exposure of internal files means sensitive records that could affect your household finances or identity are now in criminal hands.

Ordinary families in the North Bay area who worked with SolarCraft to install rooftop solar, apply for incentives, or sign power-purchase agreements are the real victims here. A single exposed spreadsheet can link your home address to financial incentives claimed, creating a roadmap for fraud or targeted phishing.

The Doxxing and Identity-Chain Risk

Stolen internal files rarely stay isolated. Attackers and subsequent buyers on dark-web markets combine them with other breaches to build detailed profiles. An email address from this incident can be cross-referenced with credential leaks from retail, streaming, or gaming services. Once an attacker controls one account, they pivot to others using password-reuse patterns, eventually mapping online handles back to real-world identities, home addresses, and family members.

Credential leaks like this one cascade into account takeovers and doxxing chains. Children’s gaming accounts are especially vulnerable because kids often reuse simplified passwords or email addresses tied to family domains. A SolarCraft-related email appearing in the stolen files can become the anchor for an attacker to seize a Roblox, Fortnite, or Discord account, then demand payment or publicly shame the household.

Alphv’s Publicly Known Track Record

Public reporting attributes the alphv ransomware group, also known as BlackCat, with emerging in late 2021. The gang has targeted organizations across healthcare, manufacturing, education, and local government. Notable prior victims include large healthcare providers and critical infrastructure companies, though exact details vary by incident. Their typical playbook involves initial access through phishing, remote-desktop compromise, or exploited vulnerabilities, followed by rapid exfiltration of sensitive files before deploying ransomware. Alphv is known for double-extortion tactics: encrypting victim systems while simultaneously threatening to release stolen data on their leak site if payment is not received. They frequently update their tooling and have rebranded after law-enforcement pressure, demonstrating resilience and adaptability.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity, then use the cleanup of Warden to break those chains.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours rather than months.
• Rotate any password you used at SolarCraft or related vendor portals anywhere it has been reused, and switch to 2FA through an authenticator app instead of SMS.
• Cover the entire household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same breached address or email.
• Let remediation specialists handle takedown requests across data brokers and extortion sites for you while you focus on securing day-to-day accounts.

The SolarCraft breach is a reminder that even regional service providers hold data that can fuel long-term identity crimes. Acting quickly on the exposure limits how far attackers can travel down the identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with full household coverage that includes children’s gaming accounts vulnerable to credential-based takeovers.