The ALPHV ransomware operation has potentially expanded their extortion strategies. On June 14, 2022, ALPHV created a clear web website that “allows the customers and employees of their victim to check if their data was stolen in an attack.” Threat actors typically slowly release portions of exfiltrated data on their Tor data leak site in order to put more pressure of the victim to pay the demanded ransom before the full data set is released. However, some victims do not succumb to this pressure and refuse to pay. ALPHV is trying out a new extortion method in which stolen data is uploaded to the new website for victims’ employees and customers to easily view. This new website has its first alleged victim, a hotel and spa location in Oregon, posted and the ransomware group claims to have stolen 112 gigabytes (GB) of data. This data that includes sensitive information of approximately 1,500 employees, such as names, Social Security numbers (SSNs), dates of birth, phone numbers, and email addresses, as well as customer data, which includes names, arrival date, and stay costs. ALPHV also created “data packs” for each potentially impacted employee, in which all files related to the individual is packed together. Anyone has the ability to view this website as the site is hosted on the public internet, and there are concerns of the information posted on the site being indexed by search engines. This indexing would allow potentially stolen and sensitive information to be added to public search engine results. Emisoft security analyst Brett Carlow discovered this new strategy and stated that “Alphv is no doubt hoping that this tactic will increase the probability of them monetizing attacks. If companies know that information relating to their customers and employees will be made public in this manner, they may be more inclined to pay the demand to prevent it from happening – and to avoid potentially being hit with class action lawsuits.” It is still too soon to tell if this new extortion strategy will be effective, and CTIX analysts will provide updates on the potential data breach involving an Oregon hotel/spa as well as the turnout of this new method as they become available.