bms.com listed on leak site by apt73

• Ransomware group: apt73
• Country: United States
• Sector: Healthcare
• Announcement date: April 27, 2026

The pharmaceutical company bms.com has been listed on a leak site by the threat group apt73. The threat actor claims to possess 302 lines of personal data belonging to the organization, marking a new potential incident involving a major player in the healthcare sector.

The alleged data breach event

The threat actor known as apt73 has listed bms.com on its leak site, alleging that it has obtained data belonging to the organization. According to the announcement made on April 27, 2026, the group has created a public entry regarding this alleged data breach to pressure the entity.

The announcement specifies that the organization operates within the pharmaceutical sector. While the group has published an entry on their platform, no information was provided regarding the specific ransom demand or the total file count associated with the incident. The group's methods typically involve pressuring organizations to compromise data confidentiality through these public listings.

Details of the claimed data exposure

The screenshot provided in the announcement displays a table containing what appears to be employee information. This data is presented as part of the group's claim to validate their access to the organization's internal systems. The information allegedly includes various corporate data points and personal details.

The specific types of data mentioned in the listing include:

• Personal data
• Employee information

Based on the visual evidence provided in the announcement, the data points appear to include names, surnames, job titles, and departments.

Organization profile

Bristol Myers Squibb is a global biopharmaceutical company that discovers, develops, and delivers innovative medicines for patients with serious diseases. It specializes in oncology, hematology, immunology, and cardiovascular diseases.

Risk assessment and industry implications

This alleged breach suggests that sensitive data belonging to an organization in the healthcare sector may have been compromised. The exposure of such data could lead to secondary risks, including identity theft and targeted phishing attacks against the affected individuals. When personal information is leaked, attackers often use it to craft highly convincing social engineering campaigns to further penetrate corporate networks or defraud employees.

Given that the organization is based in the United States, this incident may result in regulatory compliance issues under frameworks such as HIPAA. Healthcare organizations are subject to strict regulations regarding the protection of sensitive information, and breaches can trigger significant legal and administrative scrutiny.

In the broader context of cyber threats, ransomware groups often utilize leak sites to conduct double extortion. In these scenarios, attackers do not only encrypt an organization's systems but also steal sensitive data, threatening to release it publicly unless a ransom is paid. This tactic increases the pressure on companies to comply with demands to avoid reputational damage and regulatory penalties. To defend against such threats, organizations typically implement robust data encryption, strict access controls, and continuous monitoring to detect unauthorized data exfiltration.