fol-23.fr listed on apt73 leak site following alleged data breach

• Ransomware group: apt73
• Country: France
• Announcement date: January 17, 2025

A new target for apt73

The threat actor known as apt73 has listed the French organization fol-23.fr on its dedicated leak site. According to the announcement made on January 17, 2025, the group claims to have successfully breached the organization and obtained sensitive information. This listing follows a pattern often seen in modern cyberattacks where threat actors use public platforms to pressure victims by threatening to release stolen data.

The announcement, categorized as a data breach, suggests that the attackers have gained access to various internal files and credentials belonging to the organization. While the specific volume of data and the exact amount of the ransom demand have not been disclosed by the group, the threat actor has provided a sample of the alleged stolen information to demonstrate the validity of their claims.

Details of the alleged breach

The claims made by apt73 involve the unauthorized access to internal documents and sensitive login credentials. Based on the information provided in the leak site post, the group alleges it has obtained access to internal files, documents, and passwords. To support these claims, the threat actor shared a sample table via a screenshot.

This sample content appears to contain a variety of sensitive information related to the organization's operations. Specifically, the data shown in the screenshot includes:

• Employee contact information
• Usernames and passwords
• Internal documents

The presence of such information, including names, phone numbers, email addresses, and login credentials for various platforms, indicates a potential compromise of the organization's digital identity and administrative access.

About fol-23.fr

The target of this alleged attack, fol-23.fr, is the Fédération des Œuvres Laïques de la Creuse (FOL 23). This is a non-profit organization that operates within the Creuse region of France. The organization focuses its efforts on education, culture, and social welfare, serving as a central hub that brings together various associations to implement local projects. Its operations are guided by the core principles of social solidarity and secularism.

Risk assessment and security implications

The alleged leak of this information carries significant risks for both the organization and the individuals involved. The exposure of employee contact information and credentials increases the likelihood of identity theft and makes the staff and associated association members targets for highly personalized phishing attacks. Furthermore, the exposure of usernames and passwords could facilitate secondary unauthorized access attempts into the organization's digital infrastructure, allowing attackers to move laterally through their systems.

From a regulatory perspective, as an organization operating within France, fol-23.fr may face administrative sanctions due to its data protection obligations under the General Data Protection Regulation (GDPR). The breach of personal data often triggers strict reporting requirements and potential legal liabilities regarding the management of sensitive information.

The tactics employed by apt73 suggest a double-extortion strategy. In such scenarios, ransomware groups do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive data to use as leverage. By threatening to publish the data on a leak site, the attackers aim to increase the pressure on the organization to fulfill ransom demands. While public information regarding the specific methods and identity of the apt73 group remains limited, their actions align with modern ransomware trends focused on data exfiltration and public shaming.

For organizations in the non-profit and social welfare sectors, maintaining robust cybersecurity posture is essential. This includes implementing multi-factor authentication (MFA) to mitigate the risk of stolen credentials, conducting regular security awareness training to prevent phishing, and ensuring strict compliance with regional data protection laws to minimize legal and reputational damage.