Autogedal.ro listed in data breach claim by apt73

• Ransomware group: apt73
• Country: Romania
• Sector: Transportation
• Announcement date: February 18, 2025

The Romanian transportation company autogedal.ro has been targeted in a cyberattack, according to a leak site announcement. The threat actor group known as apt73 has claimed responsibility for the incident, alleging that they have successfully compromised a significant amount of data belonging to the organization.

The details of the claim

According to the announcement published by apt73 on February 18, 2025, the group claims to have gained unauthorized access to the systems of autogedal.ro. The threat actor has asserted that the breach occurred around February 7, 2025. The group has reportedly set a deadline for the publication of the stolen information and has requested that the institution contact them regarding the matter.

In many modern ransomware scenarios, threat actors employ a tactic known as double extortion. In this model, attackers do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. The threat of leaking this stolen information on a public leak site serves as additional leverage to pressure the victim into meeting ransom demands. While the specific ransom demand for this incident was not disclosed in the announcement, the presence of the organization on a leak site is a hallmark of this extortion strategy.

The alleged compromised data

The announcement includes claims regarding the volume and nature of the stolen information. The group alleges that approximately 140,000 records have been compromised, totaling roughly 3.0GB of data. Based on screenshots provided in the leak site post, the sensitive information reportedly includes a variety of administrative and personal details. A sample file shared by the group further demonstrates the presence of user identifiers and hashed passwords.

The specific types of data allegedly stolen include:

• Administrator passwords
• User information
• Email addresses
• Phone numbers
• Physical addresses
• Password hashes

The exposure of such data, particularly administrator credentials and password hashes, represents a significant security risk. When password hashes are leaked, attackers can attempt to crack them offline to gain direct access to accounts, potentially leading to further lateral movement within a network.

Organization profile

AutoGedal is a passenger transport and travel services company based in Romania. The company specializes in providing passenger transportation services, with a focus on travel and adventure-oriented trips.

Implications and organizational risks

This alleged leak poses several significant risks to both the customers and the employees of autogedal.ro. The availability of email addresses, phone numbers, and physical addresses significantly increases the risk of identity theft and highly targeted phishing attacks. When attackers possess specific personal details, they can craft more convincing fraudulent communications to deceive individuals into revealing even more sensitive information or performing financial transactions.

Furthermore, because the organization is based in Romania, this incident may have legal implications under the EU General Data Protection Regulation (GDPR). Under these regulations, organizations are often required to fulfill specific data breach notification obligations, which may include informing the relevant supervisory authorities and the affected users if the breach is likely to result in a high risk to their rights and freedoms.

The sensitivity of the alleged data could negatively impact the operational reliability of the institution and may potentially facilitate secondary cyberattacks. In the transportation sector, maintaining the integrity of user data is vital for maintaining public trust and ensuring the continuity of services. Organizations facing similar threats often implement defensive measures such as multi-factor authentication (MFA), enhanced monitoring of administrative accounts, and strict data encryption policies to mitigate the impact of unauthorized access and exfiltration.