bankily.mr Listed by APT73 Ransomware Group

Bankily.mr, the mobile banking platform operated by Banque Populaire de Mauritanie, appeared on the leak site of the ransomware group apt73 on December 09, 2024. The listing states that internal files were exfiltrated during a ransomware attack. Anyone who holds an account with the Mauritanian bank, works there, or has family members whose employment or customer records could be tied to the institution now faces heightened risk of identity exposure and follow-on fraud.

Reported Details from the Listing

The apt73 leak site lists Bankily.mr as a victim and explicitly notes that internal files were allegedly exfiltrated in a ransomware incident. The disclosure indicates that employee names and data, including an administrator’s username, appear among the stolen material. The exact number of records exposed is not stated, nor does the listing specify the full scope or sensitivity of every document taken. Public access to the leak site via ransomware.live states the posting date as December 09, 2024, and shows samples that reference the BANKILY mobile banking product.

Why This Matters for You and Your Family

When a regional bank’s internal systems are breached, the consequences reach far beyond corporate walls. Employee records can contain home addresses, national identification numbers, and payroll details that criminals use to file fraudulent loans or open accounts in your name. Customers whose data touches the same environment may see their transaction histories or linked phone numbers surface later. Because Bankily serves ordinary account holders across Mauritania, entire households can be placed at risk even if only one family member banks there. The disclosure makes clear that real operational data left the network, and that material may now be in the hands of extortionists who have already published proof of access.

Doxxing and Identity-Chain Risks

Stolen employee usernames and names provide attackers with precise starting points for credential stuffing and social-engineering campaigns. Once an admin username is paired with any reused password or personal detail, attackers can pivot into corporate systems or personal accounts. These initial footholds frequently cascade into full doxxing chains: an email address leads to a linked phone number, which reveals children’s names or gaming handles, which in turn expose family photos, addresses, and relationships. The result is a map that lets criminals target you for spear-phishing, SIM-swapping, or extortion long after the original breach fades from headlines.

apt73’s Known Track Record

Public reporting attributes apt73 with a surge in activity beginning in 2024, focusing primarily on mid-sized organizations in Africa, Latin America, and parts of Europe. The group’s typical playbook starts with initial access gained through phishing or exploited remote-desktop services, followed by rapid exfiltration of internal documents before encryption. Their extortion style combines public leak-site pressure with direct threats to publish sensitive employee or customer data unless payment is received. Notable prior victims have included regional financial institutions and service providers whose employee rosters and administrative credentials were later used in follow-on attacks. The exact tactics used against Bankily.mr remain unconfirmed, yet the group’s established pattern of publishing employee lists and internal files matches the current listing.

What to do

• Run a DoxxScan to map every link between your email addresses, phone numbers, employee usernames, and real-world identity so you can see exactly what chains exist from this claimed breach.
• Rotate any password you used at Bankily or Banque Populaire de Mauritanie wherever that same password appears, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your data surfaces you learn within hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become the next link in doxxing chains when parent credentials are exposed.
• Let DoxxScan remediation specialists manage takedown requests for any exposed personal documents or broker listings that appear after this incident.

The Bankily.mr breach is a reminder that even regional financial institutions can become gateways to personal identity compromise. Acting quickly on the credentials and personal details now circulating can limit how far attackers get. DoxxScan’s continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage including children’s gaming accounts give you and your family a practical way to stay ahead of the next wave of abuse from this and future leaks.