infraestructures.cat Listed by apos Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target public-sector and infrastructure operators across Europe, using double-extortion tactics that combine system disruption with threats to publish stolen data. Against that backdrop, the Catalan infrastructure body infraestructures.cat was listed on 12 June 2025 by the apos ransomware group, which claims to have compromised the organisation’s main server and copied its data.

Public detail remains limited: the number of people affected is unknown, and the precise contents of the material said to have been taken have not been independently confirmed. The listing itself is an unverified claim by the group, yet it still raises concrete questions for anyone whose information may have been held by the organisation.

Inside the incident

According to the apos leak-site entry dated 12 June 2025, the group states that it compromised the main server of infraestructures.cat and took a copy of all the data. The group’s own message, as reported, reads: “We have compromised your main server infraestructures.cat we also took copy of all the data. We give you 15 days before we leak the data. this can only be resolved threw our support portal we provided. Do the right thing before things get worse.”

No further technical detail has been made public. The method of initial access, the exact volume of data, the encryption status of systems, and whether any ransom was paid remain undisclosed. The only named category of material is “internal files exfiltrated in ransomware attack.” The number of individuals potentially affected is listed as unknown.

Inside apos

apos is a ransomware operation that follows the now-common double-extortion model: operators claim to encrypt systems while simultaneously exfiltrating data, then threaten public release if a payment is not made through a designated support portal. Like other groups of this type, apos maintains a leak site on which it posts victim names and, in some cases, sample files to increase pressure.

Public reporting on apos activity has documented listings of organisations across multiple sectors, typically accompanied by short claims of server compromise and data theft. The group’s statements about any specific victim, including infraestructures.cat, should be treated as claims rather than Reported Facts unless independently confirmed. No additional statements by apos about this particular incident beyond the leak-site text have been reported.

About infraestructures.cat

infraestructures.cat is the public body responsible for planning, building and managing major infrastructure projects in Catalonia. Organisations of this kind typically hold project documentation, contractor records, financial data, employee information and correspondence with government departments and private partners. Because infrastructure operators sit at the intersection of public administration and critical services, a breach can affect both operational continuity and the personal data of staff, suppliers and citizens who interact with those projects.

A successful intrusion into such an environment therefore carries consequences that extend beyond the organisation itself, potentially touching commercial partners and individuals whose details appear in internal files.

The information in question

The only data type named in the available record is “internal files exfiltrated in ransomware attack.” Exact contents remain unconfirmed. Organisations of this type commonly store project plans, contracts, personnel records, financial documents and communications. Whether any of those categories were among the material claimed by apos has not been verified, and no file counts, sample dumps or confirmed personal-data categories have been published.

Why it matters

For individuals, the practical risk is that personal or professional details held in internal files could later appear in unauthorised circulation, creating opportunities for phishing, identity misuse or targeted social engineering. For the organisation, the incident raises questions of operational resilience, contractual obligations to partners and the need to notify regulators and affected parties if personal data are confirmed to have been involved.

Because the scale and precise content remain unknown, the full extent of exposure cannot yet be measured. The 15-day deadline cited by the group has now passed without public confirmation of whether data were released, further underscoring the incomplete picture.

Were you affected?

If you have worked with, contracted for, or otherwise supplied personal or organisational data to infraestructures.cat, treat the possibility of exposure as real until more detail emerges. Practical first steps include:

• Monitor financial and email accounts for unusual activity.
• Enable multi-factor authentication on important services.
• Be cautious of unsolicited messages that reference infrastructure projects or Catalan public bodies.
• Request confirmation from the organisation itself about any notification obligations that may apply to you.

Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. Public detail on this incident remains limited; further verified information, if released, will clarify the true scope.

AICompiled with AI assistance from public sources and published under our editorial standards.