shj.ae listed on apt73 leak site following alleged data breach

• Ransomware group: apt73
• Country: United Arab Emirates
• Sector: Energy & Utilities
• Announcement date: April 27, 2026

Apt73 claims data breach at shj.ae

The threat actor known as apt73 has listed shj.ae on its leak site, alleging a significant data breach. According to the group's announcement made on April 27, 2026, the attackers claim to have obtained approximately 30 GB of data belonging to the organization. This type of activity is characteristic of modern ransomware operations, where threat actors often employ double extortion tactics. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive information to pressure the victim into paying a ransom by threatening to leak the data publicly.

To support their claims of a successful intrusion and data exfiltration, the apt73 group has shared sample documents containing personal information. This practice is common among ransomware groups seeking to demonstrate the legitimacy of their claims to both the victim and the public. While the group has provided these samples, the specific details regarding the ransom demand or the exact timing of the initial intrusion remain unknown.

Details of the alleged exfiltrated data

The information allegedly stolen by the apt73 group is diverse, spanning administrative, financial, and personal records. The group claims to have accessed a wide variety of internal documents that could provide deep insight into the organization's internal workings. According to the announcement, the stolen data includes internal letters, various attachments, and sensitive financial reports.

Furthermore, the leak appears to contain significant amounts of personal information belonging to individuals associated with the organization. The data types identified in the claim include:

• Employee personal data
• Financial reports
• Corporate correspondence

The presence of employee-specific information, such as names, dates of birth, addresses, contact details, and educational qualifications, significantly increases the sensitivity of the incident. When such data is exposed, it often serves as a precursor to further malicious activities targeting the individuals involved.

Profile of the affected organization

The organization targeted in this alleged attack is the Sharjah Electricity, Water, and Gas Authority (SEWA). SEWA is a government-owned utility provider located in the Emirate of Sharjah, United Arab Emirates. As a vital public service entity, the authority is responsible for the management and distribution of essential services, including electricity, water, and natural gas, throughout the region.

Potential risks and security implications

The alleged breach of SEWA poses several critical risks. For the employees whose personal information was reportedly stolen, there is an increased risk of identity theft and the deployment of targeted phishing attacks. Attackers can use specific details like educational qualifications or contact information to craft highly convincing social engineering campaigns.

From a corporate perspective, the exposure of financial reports and internal correspondence could potentially compromise the organization's operational security and trade secrets. Furthermore, as a utility provider responsible for essential services, this incident could pose secondary risks to critical infrastructure security. The exposure of such data may also trigger legal obligations for the organization under the data protection regulations established in the United Arab Emirates.

In response to such threats, organizations in the energy and utilities sector typically focus on strengthening their defensive postures. Common defensive steps include implementing robust multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security awareness training for employees to recognize phishing attempts. Additionally, enhanced monitoring of network traffic and data egress can help identify unauthorized data transfers before they reach a critical scale.

• Note: Publicly available information regarding the apt73 group remains limited.