Hikvision Hit by ALP-001 Ransomware Group in Massive Data Breach A newly identified ransomware group, ALP-001, has claimed responsibility for a 19.9-terabyte data breach targeting Hikvision, the Chinese-headquartered security camera manufacturer. The group listed the company as a victim on its darknet leak site on March 21, threatening to release the stolen data in 200-gigabyte increments within five days. A sample data link provided by the hackers was reportedly broken, and no ransom demand has been disclosed. Hikvision, a partly state-owned firm known for its surveillance equipment, has not responded to requests for comment. The company has faced prior scrutiny over cybersecurity vulnerabilities in its products, as well as sanctions and bans due to its alleged involvement in mass surveillance, including in China’s Uyghur internment camps. While Hikvision’s cameras remain commercially available, they were removed from government buildings in early 2023. ALP-001 emerged on the same day as its first victim listing, but cybersecurity firm ReliaQuest traced its origins to an Initial Access Broker (IAB) active on underground forums earlier this year. The group’s Tox and Session IDs matched those used by a known threat actor previously operating under aliases like "Alpha Group" and "DGJT Group." ReliaQuest identified a direct link between a French manufacturing firm ($543M revenue) listed on ALP-001’s leak site and a January 2026 access sale by the same user, suggesting the group has transitioned from selling breached access to running a full-fledged extortion operation. Despite its claims of being a "discreet collective of cybersecurity professionals," ALP-001’s actual data exfiltration capabilities remain unverified. The group positions itself as a pragmatic enterprise, offering victims a choice between a private financial settlement or public data disclosure. With Hikvision’s global presence including offices in Australia the breach raises concerns over the potential exposure of sensitive surveillance data.