The Austrian state of Carinthia was hit by a ransomware attack on Tuesday, May 24, 2022, by the ALPHV ransomware group (aka BlackCat). The attack led to severe operational disruption of government services, impacting the issuance of new passports and traffic fines as well as COVID-19 contact tracing, among others. It is estimated that 3,000 IT workstations have been affected by the attack and Carinthia’s email service and website are currently offline. ALPHV has demanded a ransom of $5 million in bitcoin for decryption software, but the head of Carinthia’s press service has stated that the ransom will not be paid as “there is no evidence that data was actually siphoned off, moreover, all data is backed up on backup systems.” APLHV has yet to upload a posting on their leak site regarding exfiltrated data from Carinthia. A portion of machines are expected to be available for use starting today, May 27, 2022. CTIX analysts will continue to track APLHV’s activity and provide necessary updates when available.