lgpunjab.gov.in listed on apt73 leak site

• Ransomware group: apt73
• Country: India
• Sector: Government & Defense
• Announcement date: November 23, 2024

The threat actor apt73 claims a data breach at lgpunjab.gov.in

The threat actor group known as apt73 has listed lgpunjab.gov.in on their leak site. According to the announcement made on November 23, 2024, the group claims to have obtained and leaked data allegedly belonging to the organization's backup CRM system. The group has claimed the attack occurred on the same day the announcement was made, November 23, 2024. Currently, information regarding this specific threat actor group remains limited in the public domain.

Ransomware leak sites are a common tool used by cybercriminals to exert pressure on victims. In many cases, these groups employ a tactic known as double extortion. In a double extortion scenario, attackers do not just encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. The threat actor then threatens to publish the stolen information on a public leak site if the ransom is not paid. This tactic significantly increases the pressure on the victim, as the threat of public exposure can lead to severe reputational damage, regulatory scrutiny, and loss of public trust.

Details of the alleged data leak

The group claims to have exfiltrated approximately 0.2 GB of data. While the specific file count and the exact ransom demand have not been disclosed by the group, the nature of the stolen information has been partially identified through evidence provided by the attackers. Based on screenshots shared on the leak site, the data is said to include various files and database backups.

The following types of data are allegedly included in the leak:

• CRM data
• Local government subscription records
• Bank verification data

The presence of various CSV and SQL database backups suggests that the attackers may have targeted structured data repositories, which often contain critical administrative and citizen-related information.

About the affected organization

The target of this alleged attack, lgpunjab.gov.in, is the official portal of the Government of Punjab, India. This platform serves a vital role in the state's administrative framework, managing activities related to the digitalization and governance of public services at the state level. Because it handles the digital interface for public services, the portal is a central component of the region's digital infrastructure.

Potential impact and security implications

The alleged leak of data belonging to a government entity poses significant risks. When sensitive information from a public institution is exposed, it can lead to the exposure of citizens' personal information. This exposure creates opportunities for malicious actors to conduct identity theft or launch highly targeted phishing attacks against individuals living within the region served by the institution. Furthermore, such incidents can raise serious concerns regarding the security of the institution's digital infrastructure and may potentially impact the continuity of essential public services.

From a regulatory perspective, the institution may face legal processes under Indian data protection regulations due to the potential exposure of citizen data. It is assessed that the threat actor's intent is to monetize the stolen data, either by demanding a ransom from the organization or by selling the information to third parties on the dark web.

To defend against such threats, organizations in the government and defense sectors typically focus on several defensive layers. This includes implementing robust access controls to limit who can access sensitive CRM and database systems, maintaining offline or immutable backups to protect against encryption, and employing continuous monitoring to detect unauthorized data exfiltration. Additionally, regular security audits and employee training to recognize phishing attempts are standard practices to mitigate the risk of initial access by threat actors.