apt73 ransomware group lists cofaco.com on its leak site

• Ransomware group: apt73
• Country: Colombia
• Sector: Agriculture and Food Production
• Announcement date: April 27, 2026

A new data breach claim targeting Cofaco Industries S.A.C.

The threat actor group known as apt73 has listed the Peruvian company Cofaco Industries S.A.C. on its dedicated leak site. According to the announcement made on April 27, 2026, the group claims to have successfully exfiltrated sensitive information belonging to the organization. While the group's public profile and history remain limited, the threat actor has initiated a countdown timer on their platform, signaling an imminent release of the alleged stolen data.

Details of the alleged attack

The claim made by apt73 suggests a significant breach of the organization's digital infrastructure. The group asserts that they have obtained a substantial volume of data, which they claim totals 3 GB in size. The announcement indicates that the breach occurred on the same day it was posted, April 27, 2026. The group has not provided information regarding a specific ransom demand.

The content of the stolen data, as described by the threat actor, includes a variety of sensitive corporate and personal records. Based on the information provided by the group, the following types of data are allegedly involved:

• Employee personal data
• Financial data
• Internal corporate documents

Furthermore, the group has provided visual evidence in the form of screenshots to support their claims. These images reportedly display tables containing sensitive information, specifically including employee names and their corresponding salary information, alongside other internal documents, financial statements, and receipts.

About Cofaco Industries S.A.C.

Cofaco Industries S.A.C. is a textile company based in Peru. The firm operates within the textile and garment industry, specifically focusing on fabric production and providing various tailoring services.

Risk assessment and industry implications

The alleged leak of such sensitive information carries several significant risks for the organization. The exposure of employee personal data, such as names and salary details, significantly increases the risk of identity theft and makes employees targets for highly specific, targeted phishing attacks. Such attacks often leverage the stolen information to gain further access to corporate systems or to defraud the individuals involved.

From a corporate perspective, the publication of financial records and internal documents could lead to the disclosure of trade secrets, potentially resulting in a loss of competitive advantage in the textile market. Additionally, the organization may face legal consequences and sanctions under the data protection regulations applicable in Peru. The breach also creates secondary security risks for the company's various supply chain partners, who may be targeted due to the connection to Cofaco Industries S.A.C.

The tactics employed by apt73, which involve the threat of public data release, are characteristic of double extortion. In these scenarios, attackers do not just encrypt systems to disrupt operations; they also steal data to pressure the victim into paying a ransom to prevent the leak. This approach places the organization's operational continuity and reputation at direct risk. To defend against such threats, organizations in the manufacturing and textile sectors often implement multi-layered security strategies, including robust encryption, strict access controls, and comprehensive monitoring to detect unauthorized data movement.