apt73 ransomware group lists northernsafety.com on its leak site

• Ransomware group: apt73
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: April 27, 2026

The threat actor group known as apt73 has listed Northern Safety Co. on its leak site, claiming to have successfully exfiltrated a significant volume of data from the organization. According to the announcement made on April 27, 2026, the group alleges that the breach occurred on September 16, 2024. The group claims that the stolen data amounts to approximately 750 GB, representing a substantial breach of corporate information.

Details of the alleged attack

The post made by apt73 identifies Northern Safety Co. as the target of their operation. The group alleges that they have obtained sensitive corporate data belonging to the organization. In the context of modern cybercrime, such listings are often part of a double extortion tactic. In these scenarios, threat actors not only encrypt an organization's systems to disrupt operations but also steal sensitive information to pressure the victim into paying a ransom by threatening to leak the data publicly on a dedicated leak site.

The group's claim suggests a targeted effort to compromise the integrity of the company's digital assets. While the specific methods used to gain access to the network have not been detailed in the public announcement, the scale of the alleged exfiltration—750 GB—indicates a significant period of unauthorized activity or a highly efficient method of data extraction. It is important to note that the accuracy and the full scope of the data claimed by the group cannot be independently verified at this time.

Data types and information involved

The information provided by the threat actor includes a sample of the stolen data to demonstrate the validity of their claim. This sample consists of a table containing specific employee details. The group alleges that the compromised information is not limited to these samples but extends to a wide variety of sensitive corporate and personal files. The following data types are claimed to have been compromised:

• Employee names
• Employee email addresses
• Corporate financial data
• HR records

The inclusion of financial records and human resources files suggests that the breach may have touched upon the core administrative and economic functions of the organization. The presence of personal employee information, such as names and email addresses, is a common outcome in such incidents and often serves as the basis for secondary attacks.

About Northern Safety Co.

Northern Safety Co., Inc. is a distributor specializing in personal protective equipment and workplace safety supplies. The company focuses on providing industrial safety products, first aid supplies, and various workplace safety solutions to its clients. As a provider of essential safety equipment, the organization plays a role in the supply chain for industrial and workplace environments.

Potential risks and organizational implications

The alleged compromise of employee and financial data carries significant risks. For the individuals whose information has been stolen, there is an increased risk of identity theft and the targeting of these employees through sophisticated phishing attacks. Such attacks often leverage the stolen contact information to gain further access to corporate systems or to defraud the individuals directly.

Furthermore, because the organization is based in the United States, the incident may trigger legal processes under various state-level data breach notification laws and other relevant regulatory frameworks. The presence of alleged financial data also introduces secondary risks that could impact the organization's supply chain partners and customers, potentially disrupting business relationships or causing financial friction.

In the retail and e-commerce sectors, maintaining operational continuity is vital. While the impact on the organization's operations remains to be fully assessed, the threat of data leaks can create significant administrative and reputational burdens. Organizations in similar sectors often focus on strengthening their defensive posture through robust access controls, continuous monitoring, and comprehensive employee training to mitigate the risks of unauthorized data exfiltration and subsequent extortion attempts.