The Keen Group Listed by ALPHV Ransomware Group

On February 23, 2023, The Keen Group, a licensed minicab and courier service operating across south London, was listed on the leak site of the Alphv ransomware group. The listing states that internal files were exfiltrated during a ransomware attack. The company’s public description notes it provides “professional, licensed, hassle-free” transport services, meaning customer names, addresses, phone numbers, payment details, and driver records are likely among the data now in attackers’ hands. Anyone who has used their minicab or courier services in recent years may have personal information exposed.

Reported Details from the Listing

The Alphv leak site entry, still accessible via the onion link hosted on ransomware.live, states that The Keen Group suffered a ransomware intrusion and that attackers successfully exfiltrated internal files. The disclosure does not quantify how many records were taken, nor does it list specific data types beyond the generic description of “internal files.” No ransom demand figure or negotiation status is published on the page. The listing appeared on February 23, 2023, and the group typically uses such postings to pressure victims into payment before releasing or selling the data.

Why This Matters for You and Your Family

If you or your family have booked a minicab or courier delivery through The Keen Group, your contact details, journey history, and possibly payment information may now sit in a criminal database. Internal files from a transport company almost always contain home addresses, telephone numbers, email accounts, and in many cases partial payment card data. Once exposed, this information rarely disappears. It circulates among brokers who package it for identity thieves, phishing campaigns, and physical stalking. For families with children who may have been picked up from school or sports clubs, the exposure creates long-term risks that extend beyond financial fraud.

The Doxxing and Identity-Chain Implications

Ransomware leaks like this one rarely stop at a single company dataset. Attackers and subsequent buyers cross-reference the stolen files against other breaches to build complete identity profiles. A south London address paired with a phone number from this leak can be chained to social-media accounts, children’s gaming usernames, or partner email addresses found in earlier breaches. These linkages allow doxxing campaigns that reveal where you live, where your children play online, and which accounts share the same passwords. Credential leaks of this nature frequently cascade into account takeovers on gaming platforms, email, and banking services. DoxxScan by GalaxyWarden continuously monitors across 13.1B+ breach records and 100+ platforms with AI-powered identity-chain mapping that surfaces these connections before they are exploited.

Alphv’s Publicly Known Track Record

Public reporting attributes the Alphv group, also known as BlackCat, with emerging in late 2021 after the shutdown of the REvil ransomware operation. The gang has targeted hospitals, schools, logistics firms, and small-to-medium businesses across multiple continents. Their typical playbook involves initial access through compromised remote desktop credentials or phishing, followed by deployment of custom ransomware that exfiltrates data before encryption. They operate a double-extortion model: demanding payment to prevent both system encryption and public release of stolen files. Listings on their leak site often remain active for weeks, with countdown timers and sample data dumps used to increase pressure. The Keen Group represents one of many transport and service-sector victims in their expanding roster.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity drawn from this and linked breaches.
• Rotate any password you have reused for The Keen Group bookings or related accounts and switch on 2FA using an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring so the next breach exposing your family is flagged within hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts tied to the same address or phone.
• Let remediation specialists handle data-broker takedown requests and opt-out processes that arise from this exposure.

The incident shows how even routine local services can become gateways to identity compromise when ransomware operators strike. Acting quickly on the exposed data chains gives you the best chance of limiting damage before criminals monetise or weaponise it. Start your DoxxScan trial and let continuous monitoring plus hands-on specialists work to protect your family and children’s online accounts from the cascading effects of leaks like this one.