apt73 ransomware group lists sella.eng.br on its leak site

• Ransomware group: apt73
• Country: Brazil
• Sector: Technology
• Announcement date: April 27, 2026

A data breach claim against sella.eng.br

The entity sella.eng.br has been listed on a leak site by the threat actor group apt73, alleging a data breach. According to the announcement made on April 27, 2026, the group claims to have successfully targeted the organization and obtained internal information. This type of activity is common in modern cyberattacks, where threat actors use leak sites to pressure organizations by threatening to release sensitive information to the public.

The claim of a breach is a central component of many modern cyber campaigns. In these scenarios, attackers often employ a strategy known as double extortion. In a double extortion scheme, the threat actor does not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data. The attackers then threaten to publish this stolen information on a public leak site if their demands are not met. This approach increases the pressure on the victim, as the threat of public exposure can lead to significant reputational damage, legal consequences, and loss of client trust.

Details of the alleged theft

The apt73 group has listed sella.eng.br on their leak site, claiming to have obtained internal data. The announcement mentions that the leaked information includes management training program documents and personal files. Regarding the volume of the stolen information, the group claims a total data volume of 0.3 GB. No information was provided regarding the specific file count or a ransom demand.

The content of the leak, as evidenced by provided screenshots, displays table-like data containing various technical details. These screenshots appear to show information such as usernames, email addresses, and various technical file directories. The specific types of data identified as being affected include:

• User email addresses
• Usernames
• Internal documents
• Personal data

When organizations face such claims, the presence of technical file directories in leaked screenshots can be particularly concerning. Such data can provide attackers with a roadmap of the internal network structure, potentially facilitating further unauthorized access or more sophisticated lateral movement within the environment.

The organization profile

Sella Engenharia is a Brazil-based engineering and management consulting firm. The company provides mentoring programs for managers and technical consulting services.

Potential risks and organizational response

The alleged breach may pose secondary risks such as identity theft or targeted phishing attacks for the organization's employees and customers. When personal data and internal documents are exposed, attackers can use the information to craft highly convincing social engineering campaigns. These targeted phishing attacks often aim to deceive employees or clients into revealing further credentials or installing malware, leveraging the stolen context to appear legitimate.

Furthermore, the nature of the leaked data could lead to the exposure of internal operational processes. For a consulting firm, the integrity of internal processes is vital to their service delivery and professional reputation. Because the entity operates in Brazil, it may face data breach notification obligations under the LGPD (General Data Protection Law). Compliance with regional data protection regulations is a critical aspect of incident response, as failure to report breaches can result in significant regulatory scrutiny and penalties.

Information regarding the apt73 group is limited in the public domain. In such cases, it is advisable for the organization to initiate a forensic investigation to determine the scope of the leak and notify affected parties. Standard defensive steps for organizations facing these threats typically include conducting a thorough audit of access logs, resetting compromised credentials, and implementing enhanced monitoring across the network to detect any ongoing unauthorized activity. Strengthening perimeter defenses and conducting regular security awareness training can also help mitigate the risk of future social engineering attempts.