tkgm.gov.tr Listed by apt73 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 22 May 2026 the ransomware group apt73 listed tkgm.gov.tr on its leak site, stating that internal files had been exfiltrated in a ransomware attack. The number of people affected and the precise volume of data remain undisclosed. The incident involves a Turkish government agency responsible for land and property records, raising questions about the handling of official documents that underpin ownership and cadastral information across the country.

Breaking down the breach

The only confirmed detail is the listing itself on 22 May 2026. No information has been released about the date of the intrusion, the method of entry, the duration of access, or whether any ransom demand was issued or met. The group’s post describes the event as a ransomware operation that resulted in the removal of internal files, but provides no further technical or quantitative data.

The group behind it: apt73

apt73 is a ransomware operator that maintains a public leak site where it lists organisations it claims to have targeted. Such groups commonly employ double-extortion tactics: data is copied before encryption, and the threat of publication is used to pressure victims. The listing of tkgm.gov.tr constitutes the group’s claim of responsibility; no independent confirmation of the breach has been published by Turkish authorities.

Who is tkgm.gov.tr?

TKGM, or the General Directorate of Land Registry and Cadastre, is the Turkish government body that maintains the national land registry and cadastral records. It registers property titles, boundaries, and related transactions for both public and private land. Agencies of this type routinely process documents that link individuals to specific parcels of land and record changes in ownership over time.

What data was at risk

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of file types, record counts, or time periods has been supplied. While land-registry agencies typically hold title deeds, identity details of property owners, transaction histories, and survey data, the exact contents of the exfiltrated material remain unconfirmed.

The real-world impact

Exposure of land-registry files could affect individuals whose property records appear in the material, potentially enabling targeted fraud or social-engineering attempts. For the agency, the incident highlights the sensitivity of systems that underpin legal property rights and government revenue collection. No statements on remediation steps or notifications to affected parties have been made public.

What to do if you're exposed

Monitor official statements from TKGM and Turkish data-protection authorities for any further disclosures. Review bank and property-related accounts for unusual activity. A short list of immediate steps includes:

• Change passwords for any online services linked to property or identity documents.
• Enable multi-factor authentication on government portals and financial accounts.
• Request copies of your land records directly from TKGM to verify accuracy.
• Run a free exposure scan of your email address against known breach datasets.

AICompiled with AI assistance from public sources and published under our editorial standards.