GLOBAL GROUP Ransomware Claims Breach of Media Giant Albavisión

The GLOBAL GROUP ransomware gang is claiming responsibility for a breach of Albavisión (albavision.tv), a major Spanish-language media conglomerate based in Miami, Florida. The group also claims to have stolen 400 GB of data.

GLOBAL GROUP is a newly emerged Ransomware-as-a-Service (RaaS) operation that has been active since early June 2025. The group has targeted multiple sectors globally, including media and healthcare, with Albavisión listed as its 29th claimed victim since its launch.

What sets GLOBAL GROUP ransomware apart from other gangs is its use of an AI-driven negotiation tool. This system employs chatbots to handle negotiations with victims, particularly those who do not speak English.

In its latest announcement posted earlier today on its dark web leak site, GLOBAL GROUP stated that Albavisión has 15 days to begin negotiations or the allegedly stolen data will be published online. While the exact ransom amount in this case is unknown, a previous incident observed by EclecticIQ showed the group demanding 9.5 BTC, which was approximately $1 million at the time.

A look at the ransomware group’s previous listings shows it has so far leaked a complete dataset of 18 victims, which also includes a hospital.

Screenshot from the GLOBAL GROUP ransomware gang’s dark web leak site. (Image credit: Hackread.com)

****Is GLOBAL GROUP Ransomware Targeting Media Giants?****

While GLOBAL GROUP has been targeting a variety of industries, its recent activity suggests a focus on media organisations. For example, the group has listed “RTE” as one of its victims, though no additional details have been provided. RTE (RTÉ) is the national television and radio broadcaster of Ireland.

However, since it remains unclear which entity the group is referring to, Hackread.com does not imply that the Irish media organisation was breached or is the intended target listed as “RTE.”

Another name on the list is Rete Toscana Classica (RTC), an Italian radio station that broadcasts classical music 24 hours a day. Both RTE and RTC have been given 7 days to respond or begin negotiations with the GLOBAL GROUP ransomware gang.

Screenshot from the GLOBAL GROUP ransomware gang’s dark web leak site. (Image credit: Hackread.com)

****Targeting Albavisión: A Calculated Move by GLOBAL GROUP?****

Targeting Albavisión appears to be a calculated move. The multinational media conglomerate operates across Latin America, owning around 45 television channels, 68 radio stations, a print publication, and approximately 65 movie theatres in 14 to 15 Spanish-speaking countries.

The company was founded in 1987 by Remigio Ángel González, a Mexican-born Guatemalan businessman who is known for acquiring struggling media outlets and turning them into profitable operations using syndicated programming and local telenovelas. González is personally estimated to be worth around $2 billion, though the exact valuation of the company itself is not publicly disclosed.

Nevertheless, GLOBAL GROUP ransomware is emerging as yet another serious cybersecurity threat to organisations worldwide. While authorities continue to struggle with the growing challenge of ransomware gangs and with even data breach-focused threat actors like Scattered Spider now moving toward ransomware, businesses must rethink their security strategies.

This is especially urgent for sectors like healthcare. Implementing clear cybersecurity policies and providing training to all staff, including those with limited access to sensitive data, is essential. Employees should be educated on phishing scams, social engineering tactics, and the risks of using work devices for personal activities.

Hackread.com has reached out to Albavisión. This article will be updated accordingly.