dunav.com Listed by apt73 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
dunav.com was listed by the apt73 ransomware group on April 27, 2026, following the exfiltration of internal files in a ransomware attack. Anyone who has interacted with the organisation should check whether their data may be affected and take appropriate protective steps.
Breaking down the breach
The incident was reported on April 27, 2026, when apt73 added dunav.com to its leak site. No independent confirmation of the intrusion or its timing has been made public. The number of people affected is not stated in available records, and the precise method of access has not been disclosed.
The group claims to have exfiltrated internal files. No further technical details, such as the volume of data or the duration of unauthorized access, appear in the reporting.
The group behind it: apt73
apt73 is a ransomware operator that maintains a leak site to publish data it says it has obtained from victims. Such groups typically gain initial access through phishing, compromised credentials or unpatched systems, then move laterally before deploying encryption and threatening to release stolen material.
The listing of dunav.com constitutes the group's claim of involvement. No separate evidence confirming that claim has been released by the organization or by investigators.
dunav.com and its sector
Dunav Insurance Company provides life, property and other insurance products to customers in Serbia. Insurance firms routinely process policy applications, claims records, medical or financial details supplied by policyholders, and internal operational documents.
A breach at an insurer can expose both customer records and corporate information that is not normally public. The long-term value of such data lies in its potential use for fraud or further targeted attacks rather than immediate resale.
What was likely exposed
The only data category named is internal files exfiltrated during the ransomware attack. No inventory of specific file types, record counts or data fields has been published.
Insurance organizations commonly hold personal identifiers, policy details and claims documentation, yet the exact contents of the material claimed by the group remain unconfirmed.
Why it matters
Individuals whose information appears in insurance records face risks of identity misuse or targeted scams if the files are later distributed. The organization itself may incur costs related to investigation, notification and remediation, regardless of whether the group's claims are fully substantiated.
Because the scale of exposure is still unknown, the practical impact on any single customer cannot yet be quantified from public sources.
If your data was in this claimed breach
Monitor statements from Dunav Insurance Company for any official notification. Review account activity at financial institutions and insurance providers for unusual transactions.
- Change passwords for any accounts linked to the insurer and enable multi-factor authentication where available.
- Request a copy of your data from the company if you hold an active policy.
- Run a free exposure scan of your email address against known breach datasets to check for additional appearances.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
viennaairport.com Listed by apt73 Ransomware Groupbg.ac.rs Listed by apt73 Ransomware Groupnovoair-bd.com Listed by apt73 Ransomware Groupwesternint.com Listed by apt73 Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the dunav.com Listed by apt73 Ransomware Group →
Publicly posted by apt73 — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.