apt73 ransomware group lists arrawdah.org.sa on its leak site

• Ransomware group: apt73
• Country: Saudi Arabia
• Sector: Government & Defense
• Announcement date: April 27, 2026

The Al Rawdah Cooperative Society, an organization based in Saudi Arabia, has been listed on a ransomware leak site by the threat actor group known as apt73. According to the announcement made on April 27, 2026, the group claims to have successfully exfiltrated a significant amount of data belonging to the organization.

The alleged data breach event

The apt73 group has officially listed the organization on their leak site, claiming to possess 5 GB of data allegedly belonging to arrawdah.org.sa. The announcement, which was posted on April 27, 2026, asserts that the breach includes a variety of sensitive materials. To pressure the target, the group has reportedly initiated a countdown timer, indicating the potential publication of the stolen information if their demands are not met.

The group's specific motivations and ransom demands have not been disclosed in the available information. Furthermore, public domain information regarding the specific identity and operational details of the apt73 group remains limited. This lack of public data makes it difficult to attribute the attack to a specific known entity or to understand their long-term objectives beyond the initial claim.

Details of the claimed stolen data

The information allegedly stolen by the apt73 group is described as being quite diverse, covering various aspects of the organization's operations. The group claims that the stolen data includes internal documents, financial statements, and personal documents. The breach is said to involve several specific types of information that could be highly sensitive for both the organization and the individuals involved.

Based on the claims made by the group, the affected data types include:

• Personal documents
• Financial statements
• Internal documents
• Corporate ID cards

Supporting these claims, the group has provided screenshots that purportedly show examples of official correspondence and corporate ID cards, which are intended to validate the legitimacy of the breach.

About Al Rawdah Cooperative Society

Al Rawdah Cooperative Society is an organization operating within Saudi Arabia. The society is dedicated to providing various social services to the local community. Its operational scope includes the implementation of support programs and the management of various cooperative activities designed to assist the local population.

Impact and security implications

The alleged leak of this data carries significant risks for the organization and its stakeholders. The exposure of personal documents and corporate ID cards may increase the risk of identity theft and fraud for the organization's employees and members. Additionally, the exposure of corporate financial data could potentially harm the operational integrity and reputation of the society.

From a legal perspective, the organization may face significant obligations under the data protection regulations established in Saudi Arabia. Furthermore, the leaked documents could potentially be utilized by threat actors in secondary attacks or targeted phishing campaigns, using the stolen information to gain further access or to deceive employees and members.

The group's approach, which involves both the theft of data and the use of a countdown timer, may be considered part of a double-extortion strategy. In such scenarios, attackers do not just encrypt systems but also threaten to release sensitive data to maximize leverage. To defend against such threats, organizations in the government and social service sectors often implement multi-layered security strategies. These typically include robust backup solutions, strict access controls, and continuous monitoring of network traffic to detect unauthorized data exfiltration. Regular security awareness training is also a common defensive step to help employees recognize and avoid the phishing attempts that often follow such breaches.