sansirostadium.com Listed by apt73 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People whose personal contact information may have been held by organisations connected to major sporting venues now face the possibility that details such as names, email addresses or phone numbers have been copied by unauthorised actors. The practical consequence is an increased chance of receiving unsolicited messages or being targeted in follow-on scams if those details are later circulated. The listing appeared on 27 April 2026. The ransomware group apt73 published sansirostadium.com on its leak site and stated that internal files had been taken during a ransomware operation. No figure for the number of individuals affected has been released, and the precise contents of the files remain undisclosed beyond the general description of internal material.

What happened

The incident came to public attention when apt73 added sansirostadium.com to its data-leak site on 27 April 2026. The group claims to have exfiltrated internal files during a ransomware attack. No independent confirmation of the volume of data or the exact date of the intrusion has been made public, and the organisation has not issued a statement detailing the scope of the event.

Who is apt73?

apt73 is a ransomware operation that has been publicly tracked for several years. Groups of this type typically gain access through phishing, stolen credentials or unpatched systems, deploy encryption to disrupt operations, and then threaten to publish stolen material unless a ransom is paid. They maintain leak sites to pressure victims by listing organisations whose data they claim to hold. The listing of sansirostadium.com constitutes the group’s assertion; it does not constitute verified proof that the data has been published or sold.

Who is sansirostadium.com?

sansirostadium.com is the online presence associated with the San Siro stadium in Milan, a venue that regularly hosts domestic and international football matches, including events under UEFA auspices. Organisations connected to such venues routinely collect contact details from ticket purchasers, hospitality guests, accreditation applicants and partner organisations in order to manage events and communications.

What was likely exposed

The only detail released is that internal files were allegedly exfiltrated. The reported summary refers to UEFA personal contact data, yet the exact categories of information contained in those files have not been confirmed. Organisations of this type commonly store names, email addresses, telephone numbers and limited event-related identifiers; whether any of these categories are present in the material claimed by apt73 is not known.

The real-world impact

Individuals whose contact details appear in the exfiltrated files could receive unsolicited commercial messages or be approached in phishing campaigns that reference the venue or past events. For the organisation, the incident adds administrative burden in the form of investigation, possible regulatory notification and the need to review access controls. No evidence of immediate large-scale misuse has been reported.

If your data was in this claimed breach

Monitor email accounts linked to any ticket purchases or registrations connected with the stadium for unusual activity. Enable multi-factor authentication on those accounts and consider using a password manager to replace any reused credentials. Readers can run a free exposure scan of their email address against known breach data sets to check whether their information appears in publicly referenced incidents.

• Change passwords for any accounts that used the same credentials as those supplied to the venue.
• Review recent statements from banks or services for signs of attempted account access.
• Remain cautious of messages that reference UEFA events or San Siro without prior context.

AICompiled with AI assistance from public sources and published under our editorial standards.