2m.ma listed on apt73 leak site following claimed data breach

• Ransomware group: apt73
• Country: Morocco
• Sector: Technology
• Announcement date: April 27, 2026

Moroccan television channel targeted by apt73 group

The Moroccan national television channel, 2m.ma, has been listed on a ransomware leak site by the threat actor group known as apt73. According to an announcement made on April 27, 2026, the group claims to have successfully compromised the organization and has subsequently made a large volume of data publicly accessible.

The claim involves a significant amount of information, with the group alleging that they have obtained approximately 30 GB of data belonging to the broadcaster. This type of public listing is a common tactic used by modern ransomware groups to increase pressure on their targets. By showcasing the stolen information on a dedicated leak site, these actors aim to demonstrate the severity of the breach and coerce the victim organization into meeting their demands.

Details of the claimed data theft

The apt73 group has provided specific details regarding the nature of the information they claim to have exfiltrated from 2m.ma. The announcement alleges that the breach includes a wide variety of sensitive materials, ranging from internal communications to highly personal documentation. The group claims that the stolen data consists of internal documents, email attachments, contact lists, and various financial records.

To support their claims of a successful breach, the group has provided screenshots as evidence. These visual samples allegedly contain sensitive items such as employee resumes, lists containing driver's licenses, and various documents used for employment verification. The breadth of the data described suggests a deep penetration into the organization's internal systems.

The specific categories of data identified in the listing include:

• Employee personal data
• Contact lists
• Financial documents
• Internal correspondence

About 2m.ma

2M is a national television channel based in Morocco. Operating in the broadcasting sector, it is one of the country's leading media organizations.

Impact assessment and industry implications

This alleged breach carries significant risks for both the organization and the individuals whose data has been compromised. The exposure of sensitive information belonging to 2m.ma employees and the organization itself could lead to severe consequences. Specifically, the leaked personal information could be exploited by malicious actors for identity theft or used to launch highly targeted phishing attacks against staff members.

Furthermore, the incident could compromise the operational privacy of the organization. Such a breach may also trigger regulatory scrutiny under Moroccan data protection laws, as the exposure of personal and financial data often falls under strict legal oversight. The threat actors involved appear to be employing double extortion tactics, a method where they not only encrypt an organization's systems but also threaten to leak sensitive data to maximize their leverage.

In the broadcasting and media sector, organizations often handle vast amounts of sensitive intellectual property and personal data for employees and contractors. To defend against such threats, organizations typically implement multi-layered security strategies. This often includes robust access controls, regular security awareness training to prevent phishing, and comprehensive encryption for data at rest and in transit. Additionally, maintaining rigorous monitoring of network traffic and implementing incident response plans are standard defensive measures to mitigate the impact of such sophisticated cyberattacks.