ALPHV claims ransomware attack on Constellation Software

Constellation Software, the Toronto-based acquirer of vertical market software businesses, confirmed on May 4, 2023 that it had been the target of a cyberattack. The company said the intrusion took place on April 3 and reached only a limited number of its IT infrastructure systems.

According to Constellation's statement, the affected systems were those used for internal financial reporting and the storage of related data drawn from its operating groups and businesses. A limited amount of personal information belonging to individuals and business partners was taken alongside business data. The company said the independent IT systems run by its operating groups and portfolio businesses were not affected and that day-to-day operations continued.

The ALPHV group, also tracked as BlackCat, listed Constellation on its dark web leak site and claimed to have exfiltrated more than one terabyte of confidential files. The gang published screenshots of documents it said came from the company's network and threatened to release everything if Constellation refused to negotiate.

Constellation said the incident had been contained and that the affected systems were restored. As of the May 2023 reporting, the company had not published a figure for how many individuals had data exposed, and it was not clear from public statements whether files on its systems had been encrypted.