apt73 ransomware group lists hl.co.uk on its leak site

• Ransomware group: apt73
• Country: United Kingdom
• Sector: Financial Services
• Announcement date: April 27, 2026

A data breach claim against Hargreaves Lansdown

The domain hl.co.uk, which belongs to the United Kingdom-based financial services provider Hargreaves Lansdown, has been listed on the leak site operated by the ransomware group known as apt73. In an announcement published on April 27, 2026, the group claimed to have accessed a database containing records belonging to a significant number of users.

According to the claim made by apt73, the breach involves the personal information of 658,259 users. To support their allegations, the group has shared a screenshot containing sample data that purportedly contains the personal information of users within the organization's systems.

Details of the alleged data leak

The announcement by the apt73 group specifies the types of information that they claim to have exfiltrated from the company's database. The group alleges that the stolen data includes a variety of sensitive personal identifiers for the 658,259 users mentioned in their post. The specific categories of data claimed to be involved include:

• Full names
• Phone numbers
• Email addresses
• Dates of birth
• Physical addresses

While the group has provided a specific count of affected individuals and shared sample data, no information was provided regarding the total size of the data stolen, the specific file count, or a ransom demand.

About Hargreaves Lansdown

Hargreaves Lansdown is a financial services company based in the United Kingdom. The firm provides a wide range of investment products and platform services to individual investors. Their service offerings include various investment funds, stocks, and pension plans, serving as a platform for diverse financial needs.

Impact and industry implications

This incident, as claimed by the threat actor, may directly impact the users of the Hargreaves Lansdown platform. The alleged leak of such sensitive personal information could significantly increase the risk of identity theft or the execution of targeted phishing attacks against the affected individuals. When personal details like dates of birth and physical addresses are compromised, attackers often use them to craft highly convincing fraudulent communications.

From a regulatory perspective, the institution may face legal obligations under the United Kingdom General Data Protection Regulation (UK GDPR) due to the nature of the data involved. Such incidents frequently lead to significant reputational damage and a potential loss of customer trust within the financial sector. Information regarding the specific capabilities and identity of the apt73 group remains limited.

Given that ransomware groups often utilize double extortion tactics—whereby they not only encrypt systems but also threaten to leak sensitive data to pressure victims—it is possible that the institution will need to conduct a thorough review of its data security processes. In such scenarios, organizations typically prioritize notifying the affected users and strengthening their defensive postures to prevent future unauthorized access. Common defensive steps for organizations in the financial sector include implementing robust encryption for data at rest and in transit, enforcing multi-factor authentication, and maintaining rigorous monitoring of network traffic to detect anomalous data exfiltration patterns.