sella.eng.br Listed by apt73 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

What happened

The listing of sella.eng.br appeared on April 27, 2026. The entry states that internal files were exfiltrated during a ransomware attack and describes the material as 0.3 GB of documents related to mentoring programs for managers, along with other internal and personal records. No confirmation of the volume, the precise file contents, or any payment demand has been made public. The number of people whose information may be involved is not disclosed.

The group behind it: apt73

apt73 is a ransomware operator that publicly lists victim organizations on a leak site when negotiations fail. Such groups typically gain initial access through phishing, stolen credentials, or unpatched systems, then move laterally to locate and copy data before deploying encryption. The listing for sella.eng.br constitutes the group’s claim of responsibility; independent verification of the data or the intrusion method has not been released.

sella.eng.br and its sector

sella.eng.br operates in the engineering and professional-services sector in Brazil, offering programs that support management development. Organizations of this type maintain records that include participant details, internal correspondence, project documentation, and administrative files. A breach involving such material can affect both the individuals named in the documents and the firm’s operational continuity.

What data was at risk

The published description refers to internal files exfiltrated in a ransomware attack, specifically noting mentoring-program materials and internal and personal documents totaling 0.3 GB. The exact categories of personal information, if any, have not been itemized beyond that description. Organizations in this sector commonly hold names, contact details, employment-related records, and training documentation, yet the precise contents of the exfiltrated material remain unconfirmed.

Why it matters

Exposure of internal and personal documents can lead to targeted phishing, reputational harm, or secondary misuse of information that was not intended for public view. For the organization, the incident adds operational costs for investigation, notification, and remediation even when the number of affected individuals is unknown. Because the scale of exposure is undisclosed, the full extent of downstream consequences cannot yet be assessed.

What to do if you're exposed

Individuals who believe their information may be involved should begin with basic account hygiene and monitoring. Organizations that hold similar data are advised to review access logs and update incident-response procedures.

• Change passwords for any accounts that may be referenced in the documents and enable multi-factor authentication.
• Monitor email and financial accounts for unusual activity over the coming months.
• Run a free exposure scan of your email address against known breach data to check for additional appearances.
• Contact sella.eng.br directly if you have a formal relationship with the organization and require confirmation of any personal data handling.

AICompiled with AI assistance from public sources and published under our editorial standards.