alkaloid.com.mk Listed by apt73 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 21, 2026, the domain alkaloid.com.mk appeared on a listing associated with the apt73 ransomware group. The entry states that internal files were exfiltrated during a ransomware operation against the Macedonian pharmaceutical company. No confirmed count of affected individuals has been released, and the organization has not issued a public statement detailing the scope or impact of the incident. This listing occurs amid ongoing ransomware activity in which groups publish victim names to pressure organizations into negotiations. Such disclosures can surface sensitive corporate or personal information even when encryption is not the primary outcome.

Breaking down the breach

The only confirmed public detail is the listing itself on May 21, 2026. The entry attributes the action to apt73 and describes exfiltration of internal files. No information has been released about the date of the intrusion, the volume of data taken, the encryption status of systems, or whether any data was subsequently published. The number of individuals whose information may be involved remains unknown.

The group behind it: apt73

apt73 is a ransomware operator that maintains a leak site to list organizations it claims to have targeted. Groups of this type typically gain initial access through phishing, compromised remote-access services, or supply-chain weaknesses, then move laterally to locate and copy data before deploying encryption tools. The listing of alkaloid.com.mk constitutes the group’s claim of involvement; independent confirmation of the underlying events has not been made public.

alkaloid.com.mk and its sector

Alkaloid is a pharmaceutical manufacturer based in Skopje, Northern Macedonia, established in 1936. Companies in this sector maintain records related to drug development, manufacturing processes, regulatory submissions, and distribution. They also hold employee data and, in some cases, information connected to clinical studies or commercial partners. A successful intrusion at such an organization can therefore expose both proprietary business information and personal data belonging to staff or research participants.

What was likely exposed

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of specific file types or data categories has been disclosed. Pharmaceutical organizations routinely store research documentation, quality-control records, personnel files, and communications with regulators and suppliers. Without a confirmed data sample or victim statement, the precise contents of any exfiltrated material cannot be verified.

Why it matters

Exposure of internal pharmaceutical files can reveal trade secrets or regulatory information that competitors or other actors might exploit. Where personal data is present, individuals face the standard risks associated with leaked employee or research records, such as targeted phishing or identity misuse. For the company, the incident adds operational disruption and potential regulatory scrutiny under data-protection rules applicable in North Macedonia and the European Union.

Were you affected?

Individuals who have interacted with Alkaloid as employees, clinical-study participants, or business partners have no confirmed public channel to determine involvement at this time. A practical first step is to monitor official statements from the company and to review any direct notifications that may be issued. Readers can also run a free exposure scan of their email address against known breach data sets to check for prior appearances in other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.