Elections.mia.gov.am targeted by apt73

• Ransomware group: apt73
• Country: Armenia
• Sector: Government & Defense
• Announcement date: June 2, 2026

A database allegedly belonging to the Armenian election system listed on leak site

The apt73 group has announced a data breach involving a database that allegedly belongs to the elections.mia.gov.am domain. According to the announcement posted on a leak site on June 2, 2026, the group claims to have obtained a significant amount of information from the target. This development represents a potential threat to the administrative processes of the Armenian electoral system.

Details of the claimed attack

The apt73 group claims to have successfully obtained a database containing 30,074 rows of data from the elections.mia.gov.am domain. The group has explicitly stated that this data is being offered for sale. Notably, the timing of this announcement is significant, as the group asserts that the data is being put up for sale ahead of the parliamentary elections. The group maintains that the information contained within the database includes the personal information of voters.

While ransomware groups often use leak sites to pressure victims through double extortion—a tactic where data is both encrypted and stolen to be used as leverage—the specific details regarding the ransom demand or the exact size of the total data volume were not provided in the announcement. The group's identity and specific operational details remain limited in the public domain.

Scope of the leaked information

The samples provided in the announcement by the group suggest a highly sensitive dataset. The information allegedly includes specific personal identifiers and logistical details related to the voting process. According to the claims, the data includes the following elements:

• Voters' first name
• Last name
• Patronymic
• Date of birth
• Address
• Polling location number
• Polling location address
• Choice

The inclusion of such granular details, particularly the combination of personal identity information with specific polling station details, highlights the potential sensitivity of the breach.

The targeted organization

The target of this alleged attack is the Department of Elections and Referendums under the Ministry of Internal Affairs of Armenia. This government body is responsible for the management and administrative processes of electoral procedures in the country, making it a critical component of the nation's democratic infrastructure.

Potential risks and implications

This alleged leak may pose significant risks to the integrity of the electoral process in Armenia. The availability of voter personal information, addresses, and polling station information on a leak site creates several secondary risks. It is assessed that the leaked data could lead to targeted phishing attacks against voters, as attackers can use the specific details to craft highly convincing fraudulent communications.

Furthermore, the sale of such data to third parties could increase risks such as identity theft. From a regulatory perspective, this situation may result in administrative and legal consequences for the institution under existing data protection regulations. For organizations within the government and defense sector, maintaining the confidentiality of voter data is paramount to public trust.

In general, when organizations face such threats, common defensive steps include implementing robust multi-factor authentication, conducting regular security audits, and ensuring strict access controls to sensitive databases. Protecting the integrity of electoral data requires continuous monitoring and proactive measures to mitigate the risk of unauthorized access to administrative and personal information.