apt73 ransomware group lists mahidol.ac.th on its leak site

• Ransomware group: apt73
• Country: Thailand
• Sector: Education
• Announcement date: April 27, 2026

Threat actor apt73 claims data breach at Mahidol University

The threat actor group known as apt73 has listed Mahidol University on its leak site, claiming to have compromised the institution's data. According to the announcement made on April 27, 2026, the group alleges that they have successfully exfiltrated approximately 1 TB of data from the organization's systems.

This type of activity is often associated with double extortion tactics used by ransomware groups. In such scenarios, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information to use as leverage. By threatening to release stolen data on public leak sites, attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential information.

Details of the alleged incident

The group's announcement claims that the breach involved the unauthorized access and theft of internal documents and emails belonging to the university. While the group has posted the organization on its leak site, the specific details regarding the method of entry or the exact timing of the initial compromise remain part of the group's claims.

Based on the screenshots provided by the threat actor in the announcement, the leaked information appears to include several types of sensitive data. The exposed materials include:

• Email addresses of university staff
• Project budget spreadsheets
• Administrative documents
• SAP system password reset notifications

About Mahidol University

Mahidol University is a prestigious public research university located in Bangkok, Thailand. Known primarily for its excellence in medicine and health sciences, it is one of the country's leading higher education institutions.

Potential impact and security implications

The exposure of this data carries significant risks for the university community. The leakage of corporate email addresses and system notifications could weaken the university's network security and potentially lead to secondary attacks. Furthermore, the availability of such information increases the risk of identity theft and targeted phishing attacks directed at university staff and students.

Beyond the immediate technical risks, the institution may face legal processes under Thailand's data protection regulations due to the exposure of sensitive information. Additionally, the leakage of academic and administrative data could have negative impacts on the institution's reputation. While the threat actor group apt73 has made these claims, information about this group remains limited in the public domain.

In the wake of such incidents, organizations in the education sector often focus on strengthening their defensive posture. Common defensive steps include implementing multi-factor authentication (MFA) across all systems, enhancing email filtering to detect phishing attempts, and maintaining rigorous monitoring of network traffic to identify unauthorized data exfiltration. Additionally, regular security awareness training for staff and students can help mitigate the risks associated with social engineering and phishing.