Cyber incident updates

Latest update

^{Update: 27 October 26}

In early May 2026, ALS Limited (ALS) experienced a cyber security incident involving unauthorised access to a limited part of our IT environment. Upon becoming aware of the incident, ALS immediately secured the affected environment and engaged specialist cyber security experts to investigate and contain the incident.

Some individuals may have received a notification or been otherwise aware of this incident from May 2026. We want to assure you this notification is not concerning a new incident.

Our investigation identified that certain personal information was accessed by an unauthorised third party. This notice is intended for individuals in Sweden, Romania, Peru, Argentina, Mexico, Ireland and the United Kingdom whose personal information was affected.

If you believe this notice may relate to you, the information below explains what happened, the information that may have been involved and the steps you can take to protect yourself.

What Happened?

The incident has been contained, and additional security measures have been implemented. Our investigation subsequently identified that certain personal information within the affected environment was accessed and subsequently published on the dark web by the unauthorised third party.

ALS has also implemented additional technical safeguards and enhanced monitoring measures and continues to monitor for evidence that affected information has been misused.

What information may have been involved?

Our investigation identified that personal information relating to certain individuals was accessed and taken by an unauthorised third party. The information affected varies between individuals and reflects information provided to, or otherwise held by, ALS in connection with their employment, engagement or other relationship with ALS.

We recognise the seriousness and importance of the matter, and understand that situations like these are concerning. We are therefore committed to supporting you through this time. If you would like to know whether your information was affected, or the specific information relating to you that was involved, please contact us at privacy@alsglobal.com.

Recommended actions

Depending on the information relating to you that was affected, there is a risk that your personal information could be used for phishing or scam attempts, identity fraud or other unauthorised activity based on the type of personal information impacted. We recommend taking the following precautionary steps to help protect your information:

Remain vigilant for suspicious emails, text messages or phone calls, particularly those requesting personal information, login credentials or payment details, and monitor accounts for unusual or suspicious activity

Avoid clicking on links or opening attachments from unexpected or unverified communications
Use strong, unique passwords for personal accounts and avoid reusing passwords across different services
Enable multi-factor authentication on personal accounts where available, particularly email and financial accounts
If financial information relating to you may be affected, monitor your financial accounts and contact your bank or financial institution if you identify any suspicious activity.
Consider replacing identity documents, such as your passport and driver license
Monitor your credit file for any applications or accounts you do not recognise
Report suspicious activity or suspected fraud to the relevant authorities in your jurisdiction
For ALS employee, if you require credit monitoring support, please email privacy@alsglobal.com and our team will be in touch to discuss the available options.

If you have any other queries, including in relation to the support that is available if you are impacted, please contact us at privacy@alsglobal.com.

Individuals also have the right to lodge a complaint with their local data protection supervisory authority if they have concerns regarding the handling of their personal data.

We understand that this incident may cause concern and sincerely regret any impact it may have on affected individuals. Protecting the security and privacy of personal information is a responsibility we take seriously, and we are committed to supporting individuals who may have been affected.

If you have any questions in the meantime, please speak with your usual ALS representative or submit an enquiry via the contacts section below.

Previous updates

Following our statement of 20 May 2026, we are providing a further update regarding the recent cyber incident.

ALS is aware that a threat actor has published information online that it claims was obtained from ALS systems during the cyber incident identified in May 2026.

Since identifying the incident, ALS has implemented containment measures, enhanced security controls and continued to strengthen monitoring across its environment.

We’ll continue to assess any notification obligations and provide updates where appropriate. ALS has notified the Australian Cyber Security Centre (ACSC) of the incident, as well as relevant regulators in applicable jurisdictions.

Protecting the information entrusted to us is a responsibility we take seriously, and we remain committed to supporting affected stakeholders and meeting our regulatory obligations.

If you have any questions in the meantime, please speak with your usual ALS representative or submit an enquiry via the contacts section below.
Following our statement of 5 May 2026, we are providing a further update regarding the recent cyber incident.

Upon identification of the incident, ALS implemented immediate technical and organisational containment measures in accordance with its incident response protocols. These measures included enhanced monitoring of network activity, isolation of affected environments and securing unaffected systems.

ALS operations have been restored, and containment activities are complete.

Importantly, ALS client portals are operating as normal and are secure to use. Our email and communications systems were also not impacted by this incident and continue to operate as normal, and it remains safe to communicate with us.

We continue to work closely with our internal teams and external cyber security specialists to understand the full scope of the incident, including assessing whether there has been any impact to data. If we identify that any client information has been impacted, we will contact relevant parties directly and immediately.

We will continue sharing further relevant information as it becomes available, with a focus on ensuring any information we communicate is accurate and verified.

If you have any questions in the meantime, please speak with your usual ALS representative or submit an enquiry via the contacts section below.
ALS Limited (ASX: ALQ) has recently identified malicious cyber activity involving unauthorised third-party access to some of our IT systems.

The incident caused temporary disruption to parts of the Group’s operations.

Our IT and security teams, supported by external cyber incident response specialists, immediately took and continues to deploy containment action, in line with our incident response procedures.

The vast majority of ALS operations have been restored and are currently operational, with targeted remediation continuing in specific areas.

We have also notified the Australian Cyber Security Centre and will coordinate with our clients, relevant government agencies and regulators.

The security and privacy of all information entrusted to us is a responsibility we take seriously. ALS continues to investigate the incident to understand the full extent and potential impacts to data and is working as quickly as possible to provide certainty for all stakeholders.

This announcement was authorised for release by the Chair of the Board.

Frequently asked questions

ALS has recently identified malicious cyber activity involving unauthorised third-party access to some of our IT systems. The incident caused temporary disruption to parts of the Group’s operations across multiple geographies. The majority of ALS operations have been restored, with targeted remediation continuing in specific areas.
Yes. ALS has notified the Australian Cyber Security Centre, and is coordinating with relevant government agencies and regulators.
Our IT and security teams, supported by external cyber incident response specialists, took immediate containment action when the incident was identified, and continue to do so in line with our incident response procedures. ALS continues to investigate the incident to understand the full extent and potential impacts to data and is working as quickly as possible to provide certainty for all stakeholders.
We are investigating what data, if any, has been impacted. We are committed to providing more detailed update as soon as our investigation progresses.
The integrity of test results has not been impacted. Your results can continue to be relied upon.
ALS client portals were not subject to the malicious activity and continue to operate as normal. You can continue to engage with these systems with no elevated risk to your data and no risk of infection of your own systems.
No. ALS’ email and communications environment has not been impacted by this incident. These systems operate in a separate environment to the affected systems and continue to operate as normal. You can continue to receive and open communications from ALS as usual. As always, we recommend remaining vigilant and verifying any unexpected requests.
This dedicated page includes the most up to date information. We will continue to update this page as more information becomes available.
Please remain alert to any unusual or unexpected communications. If you receive requests for sensitive information or changes to payment details, verify them through your usual ALS contact.
Please contact your usual ALS representative or refer to the contact details provided on this page.

Contacts

Media enquiries	ALS Media media@alsglobal.com
Investor Relations enquiries	investor@alsglobal.com
Operational or service enquiries	Contact your usual ALS representative
Cyber security enquiries

GLOBAL WEBSITE

REGIONAL WEBSITES

ALS Solutions

Geochemistry WebtrieveTM

Tribology 360

Cyber incident updates

Latest update

Previous updates

Frequently asked questions

Contacts

Geochemistry Webtrieve^TM