modplan.co.uk Listed by apt73 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized manufacturers and suppliers across the UK, using double-extortion tactics that combine system encryption with the threat of public data leaks. In this environment, even listings on criminal leak sites can signal real operational disruption and potential exposure of internal business material. On 24 October 2024, the website modplan.co.uk appeared on a listing associated with the apt73 ransomware group, which claimed that internal files had been exfiltrated during a ransomware attack. The number of people affected remains unknown, and public detail about the precise scope is limited. For customers, partners and staff connected to a long-established fenestration supplier, the incident raises practical questions about what may have been taken and what steps to take next.

The listing itself is an unverified claim by the group. No independent confirmation of the full extent of any intrusion has been published in the available record, yet the mere appearance of a company name on such a site is enough to warrant careful attention from those who deal with the organisation.

What happened

According to the reported information, modplan.co.uk was listed by the apt73 ransomware group on 24 October 2024. The group claims that internal files were exfiltrated as part of a ransomware attack. No further technical details—such as the initial access method, the duration of any intrusion, the volume of data taken, or whether systems were encrypted—have been disclosed in the public summary. The number of individuals potentially affected is listed as unknown. The organisation’s own brief description notes more than fifty years of manufacturing and supplying products for the fenestration market, but does not address the incident itself. In short, the core facts available are the date of the listing, the attribution to apt73, and the assertion that internal files were removed; everything else remains unconfirmed.

Who is apt73?

apt73 is identified in the record as a ransomware group. Like many contemporary ransomware operations, such groups typically employ double-extortion techniques: they encrypt a victim’s systems and simultaneously copy data, then threaten to publish or sell the material if a ransom is not paid. Public reporting on ransomware actors of this type shows that they often target organisations with valuable operational or customer data, using phishing, compromised credentials or unpatched remote-access services as common entry points. Once inside, they move laterally, identify high-value file shares, and stage data for exfiltration before deploying encryption. Leak-site postings serve both as pressure on the victim and as advertising for the group’s capabilities. It is important to stress that the listing of modplan.co.uk is a claim made by the group; it does not constitute independent verification of every detail of the alleged attack. No specific statements attributed to apt73 beyond the general assertion of internal-file exfiltration appear in the available facts for this incident.

Who is modplan.co.uk?

Modplan.co.uk is the online presence of Modplan, a UK company that has manufactured and supplied products to installing partners in the fenestration market for over fifty years. Fenestration covers windows, doors, conservatories and related building components—goods that sit at the intersection of construction, home improvement and commercial property work. Organisations of this kind typically maintain records of product specifications, order histories, partner and installer contact details, invoices, technical drawings and internal operational documents. They may also hold limited personal data relating to employees, contractors and business contacts. Because Modplan sits in a long supply chain serving installers and end customers, a compromise can affect not only the company itself but also the partners who rely on its products and the individuals whose details appear in order or support systems. A ransomware incident at such a firm therefore carries both operational and privacy consequences that extend beyond a single office.

What data was at risk

The available facts state only that “internal files” were exfiltrated in a ransomware attack. No inventory of specific data types—customer lists, financial records, employee information, technical drawings or otherwise—has been disclosed. Public detail is therefore limited. Organisations operating in manufacturing and supply for the fenestration sector commonly hold business-to-business contact data, order and delivery records, product documentation, pricing information and internal correspondence. They may also retain some personal data belonging to staff or individual customers. Because the exact contents of the claimed exfiltration remain unconfirmed, it is not possible to state with certainty which categories of information, if any, left the organisation’s control. Readers should treat any assumption about particular files as speculative until further official information appears.

Why it matters

Even when the precise data set is unknown, the real-world risks are concrete. For individuals whose details may have been held by Modplan—employees, installers, or customers—the appearance of internal files on a criminal site can increase the chance of targeted phishing, social-engineering calls or identity-related fraud. Attackers often use leaked business correspondence to craft convincing messages that reference real orders or projects. For the organisation itself, the incident can disrupt manufacturing and supply schedules, damage trust with installing partners, and create regulatory and contractual obligations around notification and remediation. In the broader threat landscape, ransomware listings serve as a reminder that mid-sized industrial suppliers remain attractive targets: they often possess valuable operational data yet may lack the extensive security resources of larger enterprises. The absence of a confirmed headcount of affected people does not reduce the need for caution; it simply means the scale of any personal impact is still unclear.

What to do if you're exposed

If you have a past or present relationship with Modplan—as a customer, installer, supplier or employee—treat the listing as a prompt to review your own security posture. Change passwords on any accounts that may have been linked to the company, enable multi-factor authentication wherever it is available, and remain alert for unexpected emails or calls that reference fenestration orders or technical details. Monitor financial and credit activity for unusual behaviour. Organisations that believe they may have been affected should follow their incident-response plans, preserve logs, and seek professional forensic advice. Individuals can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets; such a check provides an early indication of wider exposure and helps prioritise further protective steps. Stay calm, act on verified information, and avoid sharing sensitive details in response to unsolicited contact that claims to relate to this incident.

AICompiled with AI assistance from public sources and published under our editorial standards.