azpay.me allegedly targeted by apt73 in data leak claim

• Ransomware group: apt73
• Country: Azerbaijan
• Sector: Financial Services
• Announcement date: December 5, 2024

Apt73 claims to have leaked data from azpay.me

The ransomware group known as apt73 has published an announcement on a leak site claiming to have stolen data from azpay.me. According to the group's claims, the breach involves a significant amount of information belonging to the Azerbaijan-based organization. This incident follows a pattern often seen in modern cyberattacks where threat actors target specific industries to maximize their leverage during extortion attempts.

The group alleges that the data was acquired on 2024-12-05. While the announcement was made public on December 5, 2024, the group has reportedly set a deadline for a transaction related to this incident. It is important to note that these claims are made by the threat actor and have not been independently verified. In many such cases, ransomware groups utilize leak sites to pressure victims into paying ransoms by threatening to release sensitive information to the public.

Details of the alleged data theft

The group has provided some technical details regarding the nature of the stolen information, though they have not provided a comprehensive breakdown of every specific file or record type. The announcement indicates that the stolen data is approximately 0.84 GB in size. The group claims that the information is stored in a specific format, which may assist in understanding the potential impact of the exposure.

The specific data types mentioned in the claim include:

• SQL data

The group has not provided information regarding the total file count or the specific ransom amount demanded. The use of SQL format suggests that the stolen data may originate from a database, which often contains structured information essential to an organization's operations.

About azpay.me

azpay.me is an Azerbaijan-based financial technology company. Founded in 2018, the organization specializes in developing customized projects for various market segments. Additionally, the company provides solutions for financial intermediation, positioning itself within the critical financial services sector.

Potential risks and industry implications

This alleged leak involves a company operating within the financial services sector, a high-value target for cybercriminals due to the sensitive nature of the data they manage. The claim that the data is in SQL format could indicate the potential exposure of customer information or transaction records. Such an incident could lead to significant risks regarding data privacy regulations, as financial institutions are subject to strict compliance standards regarding the protection of user data.

Beyond the immediate regulatory concerns, secondary risks may arise from the leaked data. These include the possibility of targeted phishing attacks, where attackers use stolen details to deceive individuals, or identity theft. When databases are compromised, the information can be used to build profiles for more sophisticated social engineering campaigns.

In the broader context of cybersecurity, this incident highlights the risks associated with double extortion tactics. In these scenarios, attackers do not just encrypt a company's systems but also steal data to use as leverage. To defend against such threats, organizations in the financial sector typically implement multi-layered security strategies. This includes robust encryption for data at rest and in transit, strict access controls to limit who can query databases, and continuous monitoring to detect unauthorized data exfiltration. Regular security audits and comprehensive incident response plans are also essential components of a modern defensive posture to mitigate the impact of potential breaches.