gov.br Listed by apt73 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On June 23, 2026, the ransomware group apt73 listed gov.br on its leak site and claimed to have exfiltrated internal files in a ransomware attack. The number of individuals affected is not known, and no further details on the scope or contents of the material have been made public. The listing places the incident among other claims made by the same group, though confirmation of the data’s authenticity or volume has not been established by independent sources.

Breaking down the breach

The only confirmed public information is the date of the listing and the group’s assertion that internal files were taken. No figure for the volume of data, the date of the alleged intrusion, or the method of access has been disclosed. The organisation has not issued a statement confirming or denying the claims.

Who is apt73?

apt73 is a ransomware group that maintains a leak site where it lists organisations it claims to have targeted. Such groups typically encrypt systems and threaten to publish stolen material if a ransom is not paid. Public reporting on the group’s prior activity shows a pattern of targeting government and enterprise networks, though specific claims about gov.br originate solely from the June 2026 listing.

gov.br and its sector

gov.br operates as the official digital platform and domain zone for the Brazilian federal government. It provides citizens with access to public services, document submission, and identity-related functions across multiple agencies. Government digital platforms routinely process large volumes of administrative records and personal identifiers required for official transactions.

The information in question

The listing refers only to “internal files.” No inventory of specific data types has been released. Organisations of this kind commonly hold citizen registration details, tax records, benefit applications, and internal correspondence, but the exact material claimed in this case remains unconfirmed.

The real-world impact

Exposure of internal government files can complicate administrative processes and create opportunities for misuse of any personal information that was present. For the organisation, the incident adds to operational recovery tasks and potential scrutiny over network security. Individuals have no verified way at present to determine whether their own records were among the files referenced.

Were you affected?

Because the number of people involved and the precise contents of the files are undisclosed, no definitive list of affected individuals exists. Practical steps include monitoring official communications from Brazilian federal agencies and reviewing account activity on gov.br services.

• Change passwords for any gov.br-linked accounts and enable multi-factor authentication where available.
• Watch for unusual requests or correspondence that reference your government records.
• Run a free exposure scan of your email address against known breach data to check for prior appearances in public listings.

AICompiled with AI assistance from public sources and published under our editorial standards.