Rao.hr listed on APT73 leak site

• Ransomware group: APT73
• Country: Austria
• Sector: Technology
• Announcement date: November 23, 2024

The APT73 ransomware group has officially listed the Austrian organization rao.hr on its leak site. According to the announcement made on November 23, 2024, the threat actor claims to have successfully targeted the company, asserting that they have obtained a dataset belonging to the organization. This incident follows a claimed attack date of November 20, 2024.

The details of the claim

The APT73 group has posted an announcement on its leak site claiming responsibility for the breach of rao.hr. The threat actor states that they have acquired a dataset totaling 0.03 GB in size. This information is presented as a claim by the group, and the specific nature of the breach is characterized by the group as a data leak. According to the announcement, the stolen information consists of internal documents.

In line with common ransomware extortion tactics, the threat actor has established a deadline for the publication of the stolen data. The group has further demanded that the organization establish contact with them to resolve the situation. While the group has set these conditions, no specific ransom demand has been disclosed in the public announcement.

Data involved in the alleged breach

The announcement includes a screenshot intended to provide evidence of the breach. The visual evidence shared by the group displays various file names, suggesting the breadth of the information they claim to have accessed. Based on the information provided in the leak site announcement, the data is said to consist of internal documents. The specific types of files identified in the shared screenshot include:

• Internal documents
• Financial records
• Contracts

The total volume of the claimed data is reported to be 0.03 GB. While the group has provided a file count, no specific number of files was provided in the source information.

About rao.hr

RAO d.o.o. is an organization based in Austria and is a member of the Austria-based Best in Parking AG group. The company has a significant history in its industry, having been operating for over 25 years in the field of parking management and related technological solutions.

Impact and defensive considerations

The alleged leak of internal documents, financial records, and contracts could potentially harm the organization's operational processes and commercial confidentiality. Because the organization is based in Austria, this incident may lead to legal and administrative consequences under the EU General Data Protection Regulation (GDPR). Furthermore, the potential exposure or publication of this data could negatively impact the organization's supply chain security and customer trust.

In the broader context of cyber threats, ransomware groups often utilize a