Icicibank.com listed on apt73 leak site following claimed data breach

• Ransomware group: apt73
• Country: India
• Sector: Financial Services
• Announcement date: January 21, 2025

The threat group known as apt73 has listed icicibank.com on its leak site, claiming to possess data belonging to the institution. This announcement, made on January 21, 2025, marks a significant development in the ongoing landscape of cyber extortion targeting the financial sector.

The claimed attack and extortion attempt

According to the announcement made by the threat actor apt73, the group has successfully accessed financial data belonging to icicibank.com. The group alleges that this breach occurred on January 21, 2025. In their public listing, the group has set a deadline of January 24, 2025, demanding that the institution establish contact with them to resolve the matter.

Ransomware leak sites are a common tool used by modern threat actors to exert pressure on victims. In many cases, these groups employ a tactic known as double extortion. In such scenarios, the attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data. The threat of leaking this stolen information on a public platform serves as additional leverage to coerce the victim into paying a ransom. While the specific ransom demand has not been disclosed in the current listing, the presence of a deadline indicates an active extortion attempt.

Data involved in the alleged breach

The information provided by the threat actor includes sample data intended to prove the validity of their claims. Based on the screenshots provided by the group, the data appears to include various personal and account-related identifiers. The specific types of information identified in the sample include:

• Names
• Gender
• Account types
• City
• State information

The listing explicitly identifies the following categories of affected data:

• Customer personal information
• Account details

While the group has provided these samples, the total volume of the data stolen and the total number of files involved remain unknown, as no specific data size or file count was provided in the announcement.

The target organization

The target of this alleged attack is icicibank.com. ICICI Bank is an Indian multinational banking and financial services company. It provides a wide range of banking products and financial solutions to retail and corporate customers.

Security implications and industry considerations

This incident may increase the risk of identity theft and fraud for the institution's customers. The exposure of sensitive personal and account information can lead to customers being targeted by sophisticated phishing attacks, where attackers use stolen details to gain trust and solicit further information or funds.

For institutions operating in the financial sector, such breaches may trigger complex compliance processes with regulatory authorities. Financial entities are subject to strict data protection standards, and the unauthorized exposure of customer data often necessitates formal reporting and investigation to meet legal obligations.

The threat actor involved, apt73, is a group for which public information remains limited. In such cases, incident response teams often face challenges due to the lack of known indicators of compromise or specific patterns associated with the group. To mitigate the risks associated with such breaches, organizations typically need to review their data security protocols and inform the affected parties to allow them to take protective measures. Common defensive steps for organizations include implementing robust multi-factor authentication, maintaining strict network segmentation, and conducting regular audits of access controls to prevent unauthorized data exfiltration.