Skip to content
Ransomware

apt73 ransomware group lists amtaar.com on its leak site

amtaar.com is alleged to have had 3.5 GB of data leaked by the apt73 group on their leak site.

By
Siberpol Intelligence Unit
Published
2 min read
2 min read
  • Ransomware group: apt73
  • Country: United Arab Emirates
  • Sector: Professional Services
  • Announcement date: April 27, 2026

A data breach claim against amtaar.com

The threat actor known as apt73 has listed amtaar.com on its leak site, claiming to have successfully compromised the organization. According to the announcement made on April 27, 2026, the group alleges that it has obtained a significant amount of internal data belonging to the entity. This type of public listing is a common tactic used by ransomware groups to exert pressure on victims, often through a method known as double extortion, where stolen data is threatened with publication if demands are not met.

The group claims that the breach occurred on the same day the announcement was posted, April 27, 2026. While the listing confirms the presence of the organization on the leak site, the specific details regarding the nature of the attack remain limited to the claims provided by the threat actor. Information regarding this specific group remains limited in the public domain.

Details of the alleged data leakage

The threat actor alleges that the volume of the stolen data is approximately 3.5 GB. The announcement specifically mentions that the compromised information consists of internal documents and emails belonging to the organization. Based on the screenshots provided by the group, the leaked content appears to include various types of sensitive business information.

The data allegedly involved in this incident includes the following:

  • Internal communications
  • Emails
  • Payment requests
  • Financial data

The presence of such diverse data types suggests that the attackers may have gained access to various administrative and operational layers of the organization's digital environment. Such breaches often target communication channels and financial records to maximize the leverage held by the attackers.

About Amtaar Investment Company

Amtaar Investment Company is a UAE-based investment firm. The company is dedicated to transforming desert land into productive agricultural areas to contribute to food security. Its primary focus involves sustainable agricultural projects and food production initiatives aimed at long-term resource management.

Potential impact and organizational implications

The data alleged to have been leaked may contain sensitive information regarding the organization's operational processes and financial structure. This situation could create negative impacts on the organization's commercial reputation and lead to a loss of trust among stakeholders. Furthermore, it is possible that personal or financial information included in the leak could be utilized by third parties for identity theft or targeted phishing attacks.

Because the leaked information may include sensitive financial and communication data, legal processes may be triggered within the framework of data protection regulations in the region where the organization operates. Organizations operating in the professional services and investment sectors often face significant challenges following such incidents, as the exposure of internal workflows can reveal strategic advantages to competitors or malicious actors.

In general, when organizations face such threats, common defensive steps include implementing robust multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to prevent phishing. Monitoring for unusual network traffic and ensuring that all software is patched against known vulnerabilities are also standard practices to mitigate the risk of unauthorized access. As seen in this case, the loss of sensitive information can have cascading effects on both the legal standing and the commercial viability of a firm.

Threat Intelligence

Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.

Related stories