Servicepower.com targeted by apt73 in alleged data breach

• Ransomware group: apt73
• Country: United Kingdom
• Sector: Professional Services
• Announcement date: April 27, 2026

Apt73 claims responsibility for servicepower.com data leak

The threat group known as apt73 has published a claim on its leak site regarding a data breach involving servicepower.com. According to the announcement made on April 27, 2026, the group alleges that they have successfully targeted the United Kingdom-based organization, claiming to have exfiltrated sensitive information from the company's internal systems.

In typical ransomware or extortion-style operations, threat actors often utilize leak sites to pressure victims. These sites serve as a public platform where groups post evidence of their successful intrusions to increase visibility and leverage. While the specific details of the attack method remain undisclosed, the presence of a leak site announcement often indicates a double extortion tactic, where stolen data is used as a secondary tool to compel a victim to meet specific demands.

Details of the alleged intrusion and data theft

The threat actor, apt73, claims to have obtained a variety of internal system documents and access credentials belonging to servicepower.com. To support their claims, the group has provided screenshots that purportedly display technical details of the company's internal infrastructure. These images reportedly include authentication credentials, which are highly sensitive as they can grant direct access to protected environments.

The announcement indicates that the threat actor is demanding that the company contact them to prevent the further publication of the data. The specific nature of the ransom demand has not been disclosed in the public announcement. The group claims the stolen data consists of approximately 328 MB of information, though the total file count was not specified.

The data types identified in the claim include:

• Internal system documents
• Authentication credentials
• Jira access credentials
• AWS configuration data
• User authentication data

About servicepower.com

ServicePower is a technology company that provides field service management (FSM) software solutions. The company develops digital platforms that help businesses optimize field operations, improve customer experience, and increase workforce productivity.

Risk assessment and industry implications

This leak claim presents a significant risk of exposing critical technical information regarding the organization's internal infrastructure. The authentication credentials visible in the shared screenshots may facilitate secondary attacks or unauthorized access to the company's systems. Furthermore, the leaked information could potentially be utilized as a stepping stone for supply chain attacks, which target service providers to reach their broader client base.

Given that the organization is based in the United Kingdom, the incident may require evaluation under UK GDPR regarding data protection obligations and potential legal sanctions. Organizations operating in the professional services and software development sectors must remain vigilant against such exposures. Common defensive steps for organizations include implementing robust multi-factor authentication (MFA) to protect access credentials, strictly monitoring cloud configuration settings such as AWS, and maintaining rigorous patch management to secure internal systems.

Publicly available information regarding the specific methods and identity of the apt73 group remains limited. As with many emerging threat actors, their specific tactics, techniques, and procedures may evolve, making continuous monitoring and proactive defense strategies essential for organizations managing sensitive technical infrastructure and client-facing digital platforms.