apt73 ransomware group lists pnp.co.za on its leak site

• Ransomware group: apt73
• Country: South Africa
• Sector: Professional Services
• Announcement date: January 9, 2025

Apt73 claims to have stolen data from Pick n Pay

The threat actor known as apt73 has published an announcement on its leak site claiming to have obtained sensitive data belonging to pnp.co.za. This announcement, which appeared on January 9, 2025, marks a potential data exposure incident involving the major South African retailer. The group has initiated a countdown timer as part of its extortion tactic, requesting that the institution contact them to prevent further data exposure.

According to the claims made by the group, the breach involves a significant amount of information. The threat actor has shared a sample consisting of 105,383 lines of data, which they claim is sourced directly from the institution's user database. This method of releasing samples is a common characteristic of ransomware groups operating via leak sites, often used to pressure organizations into meeting ransom demands through the threat of total data exposure.

Details of the claimed data exposure

The announcement provided by apt73 indicates that the stolen information is highly sensitive and could be used for various malicious purposes. Based on the information shared in the leak site announcement and the provided screenshots, the data reportedly includes a variety of personal and technical identifiers. The content of the sample suggests that the breach may involve a wide range of user-specific details.

The specific types of data mentioned in the claim include:

• User credentials
• Email addresses
• Phone numbers
• Bank account information
• System access data

The presence of such diverse data types—ranging from basic contact information to sensitive financial and technical credentials—highlights the potential severity of the alleged incident. If the data is authentic, it provides a comprehensive toolkit for attackers to conduct further malicious activities against the affected parties.

About Pick n Pay

Pick n Pay is a major South African retail chain. The company operates under the Pick n Pay and Boxer brands, selling food, clothing, and general merchandise.

Potential impact and organizational risks

The alleged leak carries significant risks for both the institution and its stakeholders. For the customers and employees of the organization, the exposure of personal and financial information increases the risk of identity theft and fraud. Furthermore, the nature of the exposed data could lead to significant compliance issues under South Africa's POPIA regulations, as organizations are required to protect personal information under strict legal frameworks.

From a security perspective, the leaked information may allow attackers to target customers through highly personalized phishing attacks. Additionally, the organization may face reputational damage and potential disruption to its operational processes if the data is indeed authentic. Information regarding the apt73 group remains limited, making it difficult to determine the full scope of their operations or their specific motivations.

In such scenarios, organizations typically face the challenge of double extortion, a common ransomware tactic where attackers not only encrypt systems but also threaten to release stolen data to maximize leverage. To defend against such threats, organizations in the professional services and retail sectors often implement layered security strategies. These include robust identity and access management to protect credentials, encryption for sensitive data at rest and in transit, and continuous monitoring to detect unauthorized access. Furthermore, maintaining a strong incident response plan and ensuring compliance with regional data protection laws are critical components of a modern cybersecurity posture.