apt73 ransomware group lists bankasia-bd.com on its leak site

• Ransomware group: apt73
• Country: Bangladesh
• Sector: Financial Services
• Announcement date: April 27, 2026

Bank Asia PLC targeted by apt73

Bank Asia PLC, a prominent financial institution based in Bangladesh, has been listed on a ransomware leak site by the threat actor group known as apt73. According to the announcement made on April 27, 2026, the group claims to have successfully exfiltrated a significant amount of data belonging to the organization. The group asserts that the breach occurred on the same day the announcement was posted.

The threat actor group, apt73, claims to be in possession of approximately 1 GB of data. While the specific contents of the breach are being detailed by the attackers, public information regarding the specific identity, methods, or history of the apt73 group remains limited in the public domain. This lack of information is common in the landscape of modern cyber threats, where many groups operate with a high degree of anonymity to evade detection and attribution.

Details of the alleged data exfiltration

The claim made by apt73 suggests that the stolen data set is quite diverse in nature. The group alleges that the information includes various internal documents, financial reports, and a variety of other attachments that were part of the organization's digital environment. Based on the samples provided in screenshots released by the attackers, the leaked information appears to be highly sensitive and directly related to the bank's operations and its clientele.

The specific types of data identified in the leaked samples include:

• Customer account information
• National identification numbers (NID)
• Tax identification numbers (TIN)
• Financial transaction records
• Corporate correspondence

The presence of such highly regulated information, such as national and tax identification numbers, indicates that the breach may have a significant impact on the privacy and security of the individuals involved.

About Bank Asia PLC

Bank Asia PLC is a commercial bank headquartered in Bangladesh. The institution provides a wide range of banking services, catering to both retail and corporate clients. As a provider of essential financial services, the bank plays a critical role in the local economy, managing diverse financial needs for a broad spectrum of customers.

Risk assessment and industry implications

The nature of the data allegedly stolen from Bank Asia PLC carries significant risks. Because the information is financial in nature, there is an increased risk of identity theft and fraud for the institution's customers. When sensitive identifiers like NID and TIN numbers are exposed, they can be exploited by malicious actors to impersonate victims or conduct unauthorized financial activities.

For a financial institution, a breach of this magnitude can lead to a substantial loss of customer trust and may attract intense scrutiny from regulatory bodies. Furthermore, the exposure of personal data increases the likelihood of targeted phishing attacks, where attackers use specific details to craft convincing fraudulent communications to deceive customers. There is also a potential for secondary attack risks if information related to the institution's supply chain partners has been compromised.

The tactics employed by apt73 appear to align with double-extortion methods. In these scenarios, threat actors not only encrypt or steal data but also threaten to publish it on public leak sites to exert maximum pressure on the organization to meet ransom demands. To defend against such threats, organizations in the financial sector typically focus on robust data encryption, strict access controls, and continuous monitoring of their networks to detect unauthorized data movement.