apt73 ransomware group lists dunav.com on its leak site

• Ransomware group: apt73
• Country: Serbia
• Sector: Transportation
• Announcement date: April 27, 2026

The apt73 group claims a data breach against dunav.com

The ransomware group known as apt73 has listed the Serbian organization dunav.com on its leak site. According to the announcement made on April 27, 2026, the group claims to have successfully exfiltrated data belonging to the company. The group has initiated a countdown timer for the release of the data, which they claim is approximately 2 GB in size. While the group has made these claims publicly, information regarding the specific identity and background of apt73 remains limited in the public domain.

The incident follows the patterns often seen in modern cyber extortion campaigns. In these scenarios, threat actors typically employ a method known as double extortion. This technique involves not only encrypting an organization's internal systems to disrupt operations but also stealing sensitive information. The attackers then threaten to leak the stolen data on public forums or dedicated leak sites if a ransom is not paid. This creates significant pressure on the victim organization to meet the attackers' demands to prevent the public exposure of sensitive information.

The announcement suggests that the breach involves a variety of internal and sensitive documents. The group claims that the stolen information includes internal documents and financial statements, alongside various personal documents. This type of targeted data theft is a hallmark of advanced ransomware operations aiming to maximize leverage over their targets.

Details of the claimed data theft

The screenshots provided by the group as evidence of the breach include samples of several types of sensitive documentation. Based on the information provided in the announcement, the following types of data are allegedly included in the leak:

• Driver's licenses
• Identity cards
• Insurance policies
• Financial statements
• Personal documents

The presence of such highly sensitive personal identifiers, such as identity cards and driver's licenses, significantly elevates the severity of the incident. When personal identification information is compromised, it often leads to a cascade of secondary risks for the individuals involved. For instance, stolen identity documents are frequently used by malicious actors to conduct identity theft or facilitate fraudulent activities. Furthermore, the exposure of insurance policies and financial statements can provide attackers with the necessary context to launch highly targeted phishing attacks against the affected individuals, using the stolen information to gain trust.

About Dunav Insurance

Dunav Insurance is a well-established financial institution based in Serbia. The company provides a wide range of insurance services to its clientele, including life, property, accident, and health insurance. As a provider of diverse insurance products, the organization manages a significant volume of sensitive personal and financial information belonging to its customers and employees.

Potential impact and organizational risks

The alleged leak poses several significant risks to the organization and the individuals whose data has been targeted. For the company, the exposure of such data can lead to negative impacts on operational continuity and a loss of customer trust. Furthermore, the organization may face legal sanctions under Serbian data protection regulations due to the potential compromise of sensitive personal information.

The sensitivity of the shared data increases the risk of secondary attacks, such as phishing, against the affected individuals. For organizations operating in the financial and insurance sectors, maintaining robust data protection measures is critical. Common defensive steps to mitigate such risks include implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized data exfiltration, and conducting regular security awareness training for employees to recognize social engineering attempts. Additionally, organizations often focus on data encryption at rest and in transit to ensure that even if data is exfiltrated, it remains unreadable to unauthorized parties.

• Identity theft risk: The exposure of identity documents increases the likelihood of fraud.
• Regulatory risk: Potential legal consequences under local data protection laws.
• Reputational risk: Possible loss of customer confidence and trust.
• Operational risk: Pressure from double extortion tactics.