thebeautyclick.co.uk Listed by apt73 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target small and mid-sized online platforms across consumer sectors, listing alleged victims on leak sites as part of double-extortion campaigns that combine data theft with encryption threats. In this environment, even modest specialist websites can appear on such listings, raising questions for customers, freelancers and partners whose details may sit in company systems. On 21 October 2024, thebeautyclick.co.uk was publicly listed by the group known as apt73, which claimed to have carried out a ransomware attack involving the exfiltration of internal files. The number of people affected remains unknown, and public detail beyond the listing itself is limited.

The claim matters because platforms that connect beauty and hair professionals with clients routinely hold contact details, booking information and business records. When a ransomware group asserts it has taken internal files, those whose data may have been stored have a legitimate interest in understanding what is known, what is not, and what practical steps they can take.

Inside the incident

According to the available record, thebeautyclick.co.uk was listed by the apt73 ransomware group on 21 October 2024. The group’s claim states that internal files were exfiltrated during a ransomware attack. No further technical detail has been disclosed publicly: the precise method of initial access, the duration of any intrusion, the volume of data taken, and whether encryption was also deployed remain unconfirmed. The number of individuals whose information may have been involved is listed as unknown. The listing itself constitutes an unverified claim by the group; independent confirmation of the full scope of the incident has not been provided in the public record summarised here.

What is known is therefore narrow. A UK-based beauty and hair platform was named on a ransomware leak site, the claimed activity involved exfiltration of internal files, and the report date is 21 October 2024. Beyond those points, public information is limited.

Who is apt73?

apt73 is a ransomware operation that has appeared in public reporting as a group that conducts double-extortion attacks. In such campaigns, operators typically gain access to a network, steal data, deploy ransomware to encrypt systems, and then threaten to publish the stolen material on a dedicated leak site if a ransom is not paid. Listings on these sites are the group’s own assertions; they are not independent verification that every claimed file was taken or that every named organisation suffered the full impact described.

Like other ransomware actors of this type, apt73 is understood to favour opportunistic targeting of organisations that hold commercially useful or personal data and that may lack the resources of larger enterprises. Public knowledge of the group’s broader activity centres on this pattern of claiming data theft and posting victim names. No additional claims made by apt73 specifically about thebeautyclick.co.uk beyond the listing and the statement that internal files were exfiltrated are recorded in the facts available for this article. Readers should treat the group’s statements as claims pending further confirmation.

thebeautyclick.co.uk and its sector

The Beauty Click was founded in April 2018 by Chantelle Bass. It operates as a website and platform serving both beauty and hair specialists and, by extension, the clients who engage those specialists. Organisations of this kind typically function as marketplaces or directories that facilitate bookings, profiles and professional visibility within the personal-care sector.

The beauty and hair services sector in the United Kingdom relies heavily on digital platforms for discovery, scheduling and client communication. Such platforms commonly process names, contact details, appointment histories and business information belonging to independent stylists, therapists and salons, as well as the end customers who use the service. A ransomware claim against a platform in this space is consequential because the data held is often personal and commercially sensitive, and because many of the professionals who rely on the site are sole traders or small businesses with limited capacity to absorb disruption or identity-related fallout.

What data was at risk

The facts state that internal files were exfiltrated in a ransomware attack. No more granular inventory of data types—such as customer databases, payment records, identity documents or staff files—has been disclosed. The number of people affected is unknown.

Organisations operating beauty and hair specialist platforms typically hold account registration details, email addresses, phone numbers, booking or enquiry records, and business profiles of the professionals listed on the site. Some may also retain limited payment or invoicing information. Because the exact contents of the files claimed by apt73 have not been confirmed publicly, it is not possible to state which of these categories, if any, were included. The only confirmed description remains “internal files.” Readers should therefore treat any more specific assertions about the data as unconfirmed.

What's at stake

For individuals whose details may have been stored by the platform, the principal risks are those associated with the exposure of personal and contact information: unwanted marketing or phishing messages that exploit knowledge of a prior relationship with a beauty or hair service, and, in more serious cases, attempts at social engineering or identity misuse. Independent professionals whose business profiles or client lists were held could face commercial disruption or reputational concern if that material surfaces.

For the organisation itself, a ransomware listing can mean operational interruption, the cost of investigation and recovery, and the need to communicate with users under conditions of incomplete information. Because the scale of any compromise remains unknown, the concrete impact on both the company and its users cannot yet be quantified from public sources. The absence of confirmed numbers does not eliminate risk; it simply means that affected parties must proceed on the basis of prudent caution rather than precise knowledge of what was taken.

Were you affected?

If you have used thebeautyclick.co.uk as a client or as a beauty or hair professional, treat the listing as a reason to review your exposure. Change passwords associated with the platform and any accounts that reused the same credentials. Enable multi-factor authentication where available. Monitor bank and card statements for unexpected activity and be alert to phishing messages that reference beauty or hair bookings. Consider placing a fraud alert with relevant credit-reference services if you believe sensitive personal data may have been involved.

Public breach records are incomplete, and this incident’s full contents remain unconfirmed. Readers can run a free exposure scan of their email address to check whether that address has already appeared in other known breach data sets; such a check does not confirm or rule out involvement in this specific incident, but it provides a practical starting point for understanding wider exposure. If thebeautyclick.co.uk issues official guidance, follow those instructions in preference to general advice.

AICompiled with AI assistance from public sources and published under our editorial standards.