AAPG Listed by killsec Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional associations and mid-sized organisations across specialised industries, using data theft and public leak-site listings as leverage. In this environment, even listings that provide limited public detail can signal real operational risk for members, staff and partners who rely on the organisation’s systems.

On 1 April 2025, AAPG appeared on a killsec ransomware leak site. The group claims to have stolen internal data in a ransomware attack. The number of people affected remains unknown, and public detail about the incident is limited.

Inside the incident

According to the available record, AAPG was listed on the killsec ransomware leak site on or around 1 April 2025. The listing states that internal files were exfiltrated during a ransomware attack. The group claims to have stolen internal data. No further confirmed information has been released about the date of intrusion, the method of access, the volume of data taken, or whether any systems were encrypted. The number of individuals potentially affected is unknown. Public reporting consists solely of the leak-site claim itself; independent confirmation of the theft or of any subsequent data release has not been provided in the record.

The group behind it: killsec

killsec is a ransomware operation that has appeared in public reporting as a group practising double-extortion tactics. Like many contemporary ransomware actors, it typically gains access to networks, exfiltrates data, and then threatens to publish the material on a dedicated leak site if a ransom is not paid. The group’s listings are claims of compromise rather than independently verified disclosures. Prior public activity associated with killsec has involved a range of organisational victims, with the group using leak-site posts to apply pressure. In the present case, the only specific assertion is the listing of AAPG and the claim that internal data was stolen; no additional statements by the group about this victim are recorded in the facts.

AAPG and its sector

AAPG is the American Association of Petroleum Geologists, a long-established professional society serving geoscientists, engineers and related professionals in the energy and earth-science fields. Organisations of this type maintain membership records, conference and publication systems, research materials, and administrative files that support professional development, networking and industry standards. A breach involving such an association can affect not only staff but also members whose contact details, professional credentials or correspondence may be held in organisational systems. Because the energy and geoscience sectors often involve sensitive commercial and technical information, any compromise of internal files carries potential consequences for both the association and the broader community it serves.

What data was at risk

The facts state that internal files were exfiltrated in a ransomware attack. No more precise inventory of data types has been disclosed. Professional associations such as AAPG typically hold membership databases, contact information, event registrations, financial and administrative records, and internal correspondence or research-related materials. Whether any of these categories were among the files claimed by killsec remains unconfirmed. The exact contents of the stolen data are therefore unknown, and no verified list of exposed fields has been made public.

Why it matters

When internal files are claimed to have been taken, the practical risks include potential misuse of contact details for phishing or social-engineering attempts, exposure of professional or personal information that members and staff would expect to remain private, and possible disruption to the organisation’s operations or reputation. For individuals, the immediate concern is that their details—if present in the stolen material—could appear in later dumps or be used in targeted scams. For AAPG, the incident raises questions of continuity, member trust and the need for careful verification of any subsequent claims that data has been published. Because the scale and precise contents remain undisclosed, the full extent of impact cannot yet be measured, but the listing itself is sufficient reason for vigilance.

Were you affected?

If you are a member, staff member, partner or past registrant of AAPG, treat the claim seriously even though confirmation is limited. Practical first steps include:

• Monitor email and other accounts for unusual login attempts or phishing messages that reference AAPG or professional contacts.
• Change passwords on any accounts that reuse credentials associated with AAPG systems, and enable multi-factor authentication where available.
• Review financial and membership statements for unexpected activity.
• Remain cautious of unsolicited requests for personal or payment information that appear to come from the association or related parties.

Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. Public detail on this incident remains limited; any further official statements from AAPG or law-enforcement sources should be monitored for updates.

AICompiled with AI assistance from public sources and published under our editorial standards.