federalbank.co.in (PART1) Listed by apt73 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

For customers of an Indian bank, the possibility that personal and financial records have been taken in a cyber incident is not abstract. Names, dates of birth, permanent account numbers and family details can be used for identity fraud, targeted scams or unauthorised account activity long after the initial event. When a ransomware group publicly lists an organisation and samples of customer data, the people whose information may appear in those files face concrete questions about what was exposed and what steps they should take next.

On 24 December 2024 the ransomware group known as apt73 listed federalbank.co.in (PART1) on its leak site, claiming to have exfiltrated internal files from an Indian bank. The number of people affected remains unknown, and independent confirmation of the full scope has not been published. What is known comes from the group’s own listing and a partial sample it shared.

Breaking down the breach

Public reporting of the incident rests on the leak-site listing dated 24 December 2024. According to that listing, apt73 claims to have carried out a ransomware attack that included the exfiltration of internal files. The group described the victim as an Indian bank and stated that the full data set contained 637895 lines. A short sample of field names was posted: CUSTOMERNAME, CUST_ID_N, FNAME, DOB, PAN_NO, MNAME, LNAME, AGE, SEX, FATHERNAME and SPOU (the last field truncated in the public post). No further technical details—such as the initial access method, the encryption status of systems, or the precise date the intrusion began—have been disclosed in the available record. The number of individuals whose records appear in the claimed 637895 lines is listed as unknown. Because the information originates from the threat actor’s own site, it remains an unverified claim until corroborated by the organisation or independent investigators.

The group behind it: apt73

apt73 is a ransomware operation that follows the now-common double-extortion model: data is stolen before systems are encrypted, and the threat of public release is used to pressure the victim. Groups of this type typically maintain dedicated leak sites where they post victim names, sample files and countdown timers. They often target organisations that hold large volumes of personal or financial records, because those data sets increase leverage. Public reporting on apt73 has described it as one of several active ransomware brands that advertise themselves through such listings; specific claims made about any single victim, including federalbank.co.in (PART1), should be treated as assertions by the group rather than established fact. No independent verification of the group’s statements regarding this particular listing has been released in the material available for this report.

Who is federalbank.co.in (PART1)?

federalbank.co.in is the online presence of Federal Bank, a private-sector commercial bank headquartered in India. Like other retail and corporate banks operating in the country, it provides deposit accounts, loans, cards, digital banking and related financial services to individual and business customers. Organisations of this type routinely maintain extensive customer databases that include identity documents, contact details, account numbers, transaction histories and tax identifiers such as Permanent Account Numbers (PAN). A breach involving such an institution is consequential because the data it holds can be used to open fraudulent accounts, file false tax returns, or craft highly convincing social-engineering attacks. The “(PART1)” designation in the listing may indicate that the group intends further releases, though that remains only a claim on the leak site.

What data was at risk

The only data types named in the public record are “internal files exfiltrated in ransomware attack.” The group’s sample listing enumerates fields that include customer name, customer identifier, first name, date of birth, PAN number, middle name, last name, age, sex, father’s name and spouse-related information. These field names suggest customer-profile records rather than purely technical system logs. Exact contents of the full 637895-line set have not been independently verified, and the total number of unique individuals represented is unknown. Banks typically store additional categories of information—addresses, phone numbers, account balances, loan details and authentication credentials—but none of those have been confirmed as present in this incident. Until the organisation or a forensic report provides a verified inventory, the precise scope of exposure remains unconfirmed.

What's at stake

For individuals whose records may be among the claimed files, the practical risks include identity theft, unauthorised loan applications, tax-related fraud using a stolen PAN, and phishing campaigns that reference real personal details to appear legitimate. Family-related fields such as father’s name or spouse information can further enable social-engineering attacks against relatives. For the bank itself, the incident raises questions of customer notification obligations under Indian data-protection and banking regulations, potential regulatory scrutiny, and the cost of remediation and monitoring services. Because the volume of affected people is still listed as unknown, both the personal and institutional impact cannot yet be quantified with precision. The longer the data remains in the hands of criminals, the greater the window for secondary misuse.

What to do if you're exposed

Anyone who holds an account or has previously shared personal details with Federal Bank should treat the listing as a prompt for caution rather than confirmed individual exposure. Monitor bank statements and credit reports for unfamiliar activity, enable multi-factor authentication on all financial accounts, and be sceptical of unsolicited calls or messages that reference personal information. Consider placing a fraud alert with credit bureaus if you are an Indian resident. Free tools exist that allow you to check whether your email address has already appeared in known breach data sets; running such a scan can help determine whether your contact details have surfaced elsewhere and whether additional monitoring is warranted. If you receive formal notification from the bank, follow the specific guidance it provides, including any offer of credit monitoring or identity-protection services.

AICompiled with AI assistance from public sources and published under our editorial standards.