tkgm.gov.tr listed on leak site by apt73

• Ransomware group: apt73
• Country: Türkiye
• Sector: Government & Defense
• Announcement date: May 22, 2026

The threat actor apt73 claims a breach of tkgm.gov.tr

The General Directorate of Land Registry and Cadastre (TKGM) has been listed on a leak site by a threat actor group known as apt73. According to the announcement made on May 22, 2026, the group claims to have successfully infiltrated the institution and obtained various types of sensitive information. The threat actor group asserts that they have acquired a significant amount of data belonging to the agency.

The event involves a leak announcement published by the apt73 group specifically targeting the tkgm.gov.tr domain. The group claims to have acquired a total of 6,208 files through their operation. The announcement includes a countdown timer, a common tactic used by ransomware groups to exert psychological pressure on the targeted institution to meet specific demands.

The alleged stolen data and contents

The content of the alleged breach, as described by the threat actor, includes a variety of sensitive materials. The group claims to have access to internal documents, personal information, photographs, and financial reports. To support their claims, the group has shared sample images in their announcement, which reportedly include a Republic of Turkey identity card and various tabular data sets.

The specific types of data allegedly affected include:

• Identity information
• Financial data
• Personal photographs
• Corporate internal documents

The organization profile

The General Directorate of Land Registry and Cadastre (TKGM) is a government agency operating under the Ministry of Environment, Urbanization and Climate Change in Turkey. The institution is responsible for the critical task of maintaining property records and managing various mapping and cadastre services across the country.

Analysis and implications of the incident

This incident highlights the significant risks associated with data breaches targeting government institutions. The alleged exposure of identity information may lead to secondary risks for the affected individuals, such as identity theft and fraud. Furthermore, the disclosure of corporate data could trigger legal processes and administrative sanctions under local data protection laws, specifically the Law on the Protection of Personal Data (KVKK).

Beyond the immediate legal and administrative implications, the stolen data may be leveraged by threat actors for targeted phishing campaigns against individuals or the institution itself. Such campaigns often use stolen personal details to build trust and deceive victims into revealing further credentials or transferring funds.

In the broader context of cybersecurity, this incident reflects the growing trend of double extortion. In these scenarios, threat actors do not only encrypt an organization's systems to disrupt operations but also steal sensitive data to threaten its public release. This dual-layered approach increases the pressure on organizations to comply with ransom demands to prevent reputational damage and legal consequences.

Organizations in the government and defense sector often face sophisticated threats due to the sensitive nature of the data they manage. To mitigate these risks, it is common practice for institutions to implement robust defensive measures. These include strict access controls, continuous monitoring of network traffic, and regular security awareness training for employees to recognize phishing attempts. Additionally, maintaining comprehensive backups and ensuring data encryption at rest and in transit are fundamental steps in defending against unauthorized data exfiltration.

At this time, information regarding the specific identity and methods of the apt73 group remains limited in the public domain.