apt73 ransomware group lists www.prixet.com on its leak site

• Ransomware group: apt73
• Country: Spain
• Sector: Technology
• Announcement date: December 16, 2024

Apt73 claims to have breached Prixet

The threat actor known as apt73 has listed data allegedly belonging to the technology company Prixet on its leak site. This announcement, made on December 16, 2024, marks a significant development in the ongoing activity of the group. According to the post on the leak site, the group claims to have targeted the entity www.prixet.com, asserting that they have successfully compromised various internal assets.

The claims made by the threat actor suggest a multifaceted breach. The post alleges that internal documents, passwords, and personal information have been compromised during the attack. While the group has made these claims public, it is important to note that information regarding this specific threat actor remains limited in the public domain, making it difficult to ascertain their full scope of operations or specific methodologies.

Details of the alleged data theft

Based on the file lists provided in the screenshots associated with the leak site announcement, the breach involves a wide variety of sensitive information. The data allegedly exfiltrated covers multiple categories, ranging from user-specific details to technical infrastructure files. The scope of the leaked information suggests a significant impact on the organization's data privacy.

The following data types have been identified as potentially compromised according to the group's claims:

• User data
• Email addresses
• Restaurant information
• Reservation records
• Ticket information
• Survey results
• Voucher data
• Passwords

The inclusion of technical configuration files alongside personal user data indicates that the breach may impact both the operational integrity of the company and the privacy of its individual users.

About Prixet

Prixet is a technology company with a presence in Europe and the Caribbean. The organization specializes in data creation and hotspot technologies. Their primary business model involves providing data collection and analysis services by establishing hotspot networks in various locations across their operational regions.

Impact and risks of the breach

The alleged leak poses several secondary risks that could impact both the organization and its stakeholders. For the employees and customers of the organization, the exposure of personal information and passwords increases the risk of identity theft and the likelihood of targeted phishing attacks. Such attacks often leverage stolen email addresses and personal details to deceive individuals into revealing further sensitive information.

Because the organization operates within Europe, this incident may trigger significant legal considerations. The potential for data protection obligations and administrative sanctions under the General Data Protection Regulation (GDPR) is a relevant factor for the organization to consider. Furthermore, the threat actor's intent to publish the stolen data can lead to a negative impact on the organization's commercial reputation.

This incident appears to follow the double extortion method, a common tactic in modern ransomware attacks. In this scenario, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. The threat actor threatens to leak the data if a ransom is not paid. It is important to note that even if an organization chooses to pay the ransom, there is no guarantee that the stolen data will be completely deleted by the attackers.

For organizations in the technology and data services sector, such incidents highlight the necessity of robust defensive measures. Common industry practices to mitigate such risks include implementing multi-factor authentication, maintaining rigorous data encryption standards, and conducting regular security audits. Strengthening incident response plans and ensuring comprehensive logging and monitoring are also vital steps for organizations to detect and respond to unauthorized access attempts more effectively.