sokkakreatif.com Listed by apt73 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations by combining encryption with data theft and public leak-site listings, a pattern that has become a routine feature of the current threat landscape. On 29 October 2024, the domain sokkakreatif.com appeared on a listing associated with the apt73 ransomware group, marking another instance in which a corporate entity has been named in connection with claimed data exfiltration.

Public detail remains limited. The listing asserts that internal files were taken in a ransomware attack against PT. Sokka Kreatif Teknologi, yet the number of people affected, the precise volume of data, and independent confirmation of the claim have not been disclosed. For individuals and partners who may have dealt with the company, the incident raises practical questions about what information could be at risk and what steps are prudent while further facts emerge.

Inside the incident

According to the available record, sokkakreatif.com was listed by the apt73 ransomware group on 29 October 2024. The group claims that internal files were exfiltrated during a ransomware attack. No further technical details—such as the initial access vector, the encryption timeline, any ransom demand, or the total size of the stolen data—have been made public. The number of individuals potentially affected is recorded as unknown. Independent verification of the listing has not been reported, so the claim stands as an assertion by the threat actor rather than a claimed breach disclosure from the organisation itself.

In the absence of additional statements from PT. Sokka Kreatif Teknologi or law-enforcement sources, the public picture is confined to the date of the listing and the general description of “internal files” taken. Timing of the underlying intrusion, the duration of any dwell time inside the network, and whether systems remain encrypted or restored are all undisclosed.

Inside apt73

apt73 is known publicly as a ransomware operation that follows the now-common double-extortion model: encrypting systems while simultaneously copying data and threatening to publish it on a dedicated leak site if payment is not made. Like many contemporary ransomware groups, it typically advertises victims by name or domain, posts samples or file lists to demonstrate possession of data, and sets deadlines intended to increase pressure. Prior activity attributed to the group has involved a range of commercial and institutional targets, though specific claims about any single victim must be treated as unverified until corroborated.

In this case the group claims to have listed sokkakreatif.com after an attack that included exfiltration of internal files. No public statements from apt73 beyond the listing itself are recorded in the available facts, and no independent forensic confirmation has been released. The listing therefore functions as an allegation rather than established fact.

sokkakreatif.com and its sector

PT. Sokka Kreatif Teknologi was established in 2017 and operates as a subsidiary of PT. Persada Inti Utama. The parent company’s main businesses include telecommunications. Organisations of this type commonly handle corporate records, customer or partner contact information, contractual documents, technical configurations, and internal operational data related to telecommunications services and technology projects.

A breach affecting such an entity is consequential because telecommunications-related firms often sit at the intersection of commercial, technical and sometimes regulated data flows. Even when the precise contents of a claimed theft remain unconfirmed, the potential exposure of internal files can affect business partners, employees and any individuals whose information appears in those files. The subsidiary relationship also means that operational or reputational impact may extend beyond the single domain named in the listing.

What was likely exposed

The facts state only that “internal files” were exfiltrated in a ransomware attack. No inventory of file types, databases, email archives or personal data categories has been published. Exact contents therefore remain unconfirmed.

Organisations in the telecommunications and technology sector typically hold employee records, customer or client contact details, project documentation, financial and contractual materials, network diagrams, and internal correspondence. Any of these categories could theoretically be present among “internal files,” yet it would be inaccurate to assert that specific data types were taken. Until a formal disclosure or independent analysis appears, the public record supports only the general claim of internal-file exfiltration.

What's at stake

For people whose information may have been stored by PT. Sokka Kreatif Teknologi, the principal risks are the ordinary consequences of data exposure: possible misuse of contact details for phishing or social-engineering attempts, and the longer-term possibility that personal or commercial information could circulate if the threat actor publishes it. Because the number of affected individuals is unknown and the precise data types are undisclosed, the scale of personal impact cannot yet be quantified.

For the organisation itself, a ransomware incident that includes claimed data theft can disrupt operations, strain relationships with partners and clients, and create regulatory or contractual obligations to investigate and notify. Even when systems are restored, the lingering uncertainty about what was copied can require extended monitoring and remediation. None of these outcomes has been confirmed in public reporting; they represent the standard stakes associated with this class of incident rather than proven consequences of the present listing.

Were you affected?

If you have had dealings with sokkakreatif.com or PT. Sokka Kreatif Teknologi—whether as an employee, customer, supplier or partner—treat the listing as a signal to remain alert rather than as proof that your own data has been compromised. Practical first steps include monitoring financial and email accounts for unusual activity, enabling multi-factor authentication where available, and treating unexpected messages that reference the company with caution. Because the exact contents of any stolen files remain unconfirmed, there is no public list of affected individuals against which to check.

Readers who wish to see whether their email address has already appeared in known breach data sets can run a free exposure scan. Such a check does not confirm or rule out involvement in this specific incident, but it can surface earlier exposures and help prioritise further protective measures while more information about the October 2024 listing becomes available.

AICompiled with AI assistance from public sources and published under our editorial standards.