apt73 ransomware group lists haca.ma on its leak site

• Ransomware group: apt73
• Country: Morocco
• Sector: Government & Defense
• Announcement date: April 27, 2026

The threat actor known as apt73 has published a data leak announcement targeting the haca.ma domain. According to the claim made on April 27, 2026, the group has successfully exfiltrated a significant amount of data belonging to the Morocco-based High Authority for Audiovisual Communication (HACA).

Details of the alleged attack

The announcement made by apt73 indicates that the attack took place on April 27, 2026. The threat actor claims to have obtained various types of sensitive information from the organization's internal systems. Specifically, the group asserts that they have acquired the organization's internal documents, letters, attachments, and financial reports. The total volume of the data claimed to have been leaked is approximately 10 GB.

While the announcement focuses on the volume and types of files, no specific information was provided regarding the total file count or the amount of a ransom demand. The incident is categorized as a data leak announcement on a leak site, which is a common tactic used in modern cyberattacks to pressure victims.

Alleged compromised data types

The information released by the threat actor suggests that a variety of corporate and administrative files were part of the breach. The data reportedly includes:

• Internal corporate documents
• Financial reports
• Correspondence

Visual evidence provided in the announcement, such as screenshots, reportedly displays various corporate tables and event photographs, further supporting the group's claims regarding the nature of the stolen information.

About the High Authority for Audiovisual Communication

HACA (High Authority for Audiovisual Communication) is an independent public institution located in Morocco. The organization serves a critical role in the country's media landscape by regulating and supervising the audiovisual communication sector. Its primary responsibility is to ensure that all broadcasting activities within the jurisdiction comply with established legal and ethical standards.

Potential impact and organizational risks

The alleged leak of such a substantial amount of data poses significant risks to the operational confidentiality of the organization. The presence of financial reports among the claimed leaked data could lead to the exposure of sensitive information regarding the economic activities of the institution. Such exposure can create grounds for identity theft or targeted phishing attacks directed at employees and various stakeholders of the organization.

Furthermore, when leaks target government institutions, they can have negative impacts on public trust and the overall reputation of the organization. In the context of modern cyber threats, such incidents often follow a pattern of double extortion, where threat actors not only encrypt an organization's data but also threaten to release it publicly to increase pressure for payment. While the specific details of this group's methods are limited, such tactics are increasingly common in the current threat landscape.

For organizations operating within the government and defense sectors, maintaining robust cybersecurity postures is essential to mitigate these risks. Common defensive steps include implementing strict access controls, maintaining regular offline backups, and conducting continuous monitoring of network traffic to detect unauthorized exfiltration. Protecting sensitive correspondence and financial data is vital to preventing the downstream effects of identity theft and maintaining public confidence in state institutions.