Medikaplaza.com listed on apt73 ransomware leak site

• Ransomware group: apt73
• Country: Pakistan
• Sector: Healthcare
• Announcement date: April 27, 2026

A new data breach claim targeting medikaplaza.com

The healthcare provider medikaplaza.com has been listed on the leak site of the threat actor group known as apt73. According to the announcement made on April 27, 2026, the group claims to have successfully exfiltrated 15 GB of data belonging to the organization. This development marks a significant incident for the Indonesian-based medical service provider, as the threat actors have moved to publicize their alleged access to the organization's sensitive information.

Details of the alleged attack by apt73

The threat actor identified as apt73 has posted a listing on their platform claiming ownership of documents related to the medical services and corporate health checkups provided by medikaplaza.com. The announcement includes a countdown timer, a tactic frequently employed by ransomware groups to exert psychological pressure on a target organization to meet their demands before the data is released publicly.

Publicly available information regarding the specific identity, origins, or technical capabilities of the apt73 group remains limited. While the group's announcement suggests a targeted operation, their presence in the public domain is currently characterized by a lack of detailed intelligence. The group appears to be utilizing double extortion tactics, a method where attackers not only encrypt an organization's systems but also threaten to leak sensitive data to force a ransom payment.

Compromised data types and samples

Based on the screenshots and information provided in the leak site announcement, the attackers claim to possess a variety of sensitive documents. The leaked samples displayed in the screenshots include highly sensitive items such as invoices, receipts, and images of personal identification cards. The scope of the alleged compromise covers several categories of information, including:

• Financial statements
• Internal documents
• Personal identification information
• Invoices

The breadth of these claims suggests that the attackers may have gained access to various administrative and operational layers of the organization, ranging from financial records to individual identity documents.

Organization profile: medikaplaza.com

Medika Plaza is a healthcare organization based in Indonesia. The institution provides a variety of medical services as well as specialized corporate health services to its clients.

Implications for the healthcare sector and data protection

The alleged compromise of data within the healthcare sector presents significant risks to patient privacy and the protection of sensitive personal data. When medical institutions are targeted, the sensitive nature of the information involved can lead to severe consequences for both the organization and the individuals whose data has been exposed. The exposure of such data could potentially lead to identity theft or targeted phishing attacks against employees and patients.

Furthermore, such a leak may damage the commercial reputation of the organization and lead to disruptions in operational processes. From a regulatory perspective, the organization may face legal proceedings under Indonesian data protection regulations due to the potential exposure of personal information. The use of double extortion tactics by groups like apt73 highlights the evolving nature of ransomware, where the threat of data exposure is used as a primary lever for extortion.

In general, organizations in the healthcare sector can mitigate these risks by implementing robust security frameworks. This includes maintaining strict access controls, conducting regular security audits, and ensuring that data encryption is applied to both resting and transit data. Strengthening incident response plans and increasing employee awareness regarding phishing attempts are also critical components of a comprehensive defense strategy against modern ransomware threats.