Ransomware Group: APT73

VICTIM NAME: federalbank[.]co[.]in (PART1)

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the APT73 Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The ransomware leak concerns a financial services institution in India, specifically identified as “Federal Bank.” The leak page from the group known as APT73 suggests the exposure of a significant amount of sensitive information, which includes identifiers and personal details pertaining to numerous customers. The information shared consists of 637,895 lines detailing customer data such as names, identification numbers, and demographic information. This data breach raises serious concerns regarding the privacy and security of individuals associated with the bank. The exact compromise date is unspecified but the leak was discovered on December 24, 2024.

The leak page provides a screenshot that appears to represent a portion of the exposed data. The sensitive nature of the disclosed information necessitates a high level of scrutiny and response from cybersecurity professionals and regulatory bodies. While the bank has yet to publicly address the breach, the availability of a substantial volume of customer data on the dark web signifies deep security vulnerabilities that must be promptly addressed. Moreover, the leaked data presents potential threats of identity theft and financial fraud against the affected individuals. As of now, the specific download links are not provided, but the presence of such links would allow wider access to the compromised information.