Borrer Executive Search Listed by APT73 Ransomware Group

On June 13, 2024, Borrer Executive Search appeared on the leak site operated by the ransomware group apt73. The Swiss executive search firm, accredited by the Association of Executive Search and Leadership Consultants, may have had its internal files exfiltrated during a ransomware attack. The listing does not specify how many individuals are affected or list exact record counts.

Details from the Leak Site

The apt73 leak site states that Borrer Executive Search suffered a ransomware incident in which attackers exfiltrated internal documents and agreements. No sample data has been published at the time of the listing, and the disclosure does not quantify the volume or specific categories of information taken. The entry simply states that files were stolen and that the company has not yet met the group’s demands. Ransomware.live mirrors the original onion-site posting, providing the primary public record of the incident.

Internal files and agreements are the only data types explicitly referenced. The leak site does not detail whether client resumes, candidate personal information, contracts with corporate partners, or employee records were included.

Why This Matters for You and Your Family

When an executive search firm is breached, the people whose data sits in its files face direct exposure. If you or anyone in your household has ever worked with a recruiter, applied for a senior role, or had your CV forwarded to Borrer Executive Search, your name, contact details, employment history, salary expectations, and sometimes home address may now sit in an attacker’s archive. That information rarely travels alone. It combines with other breaches to build a complete picture of your professional and personal life.

Even if you never interacted directly with this firm, family members or partners may have. Executive search databases often contain spouse names, references, and emergency contacts. The exposure therefore reaches beyond the immediate candidate to the wider household.

Doxxing and Identity-Chain Risks

Stolen internal documents from recruitment firms are high-value fuel for doxxing chains. Attackers can link your professional identity to personal email addresses, phone numbers, and physical locations mentioned in agreements or notes. Once those connections surface on criminal forums, they enable everything from targeted phishing and SIM-swapping to full identity theft. Credential leaks of this kind also cascade into account takeovers, including gaming accounts belonging to you or your children that reuse the same passwords or recovery emails.

The real danger is the speed at which these chains form. What begins as a recruitment record can, within weeks, appear in extortion packages that include your current address, family member names, and online handles.

apt73’s Known Track Record

Public reporting attributes apt73 with emerging in late 2023 as a ransomware and extortion operation. The group typically gains initial access through phishing or exploitation of remote desktop services, exfiltrates data before deploying ransomware, and then runs a double-extortion playbook: demanding payment both to decrypt systems and to prevent publication of stolen files. Notable prior victims include mid-sized European companies in professional services and manufacturing sectors. The group maintains its own leak site and frequently uses ransomware.live as a secondary distribution channel. Its extortion style focuses on tight deadlines and selective release of sample documents to pressure victims.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real-world identity, then use the cleanup of Warden to remove what you can.
• Rotate any password you ever used at Borrer Executive Search or related recruitment portals, and enforce 2FA through an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught and acted on in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same addresses and recovery details exposed in breaches like this.
• Let remediation specialists handle takedown requests across data brokers and extortion sites on your behalf while you focus on securing your own accounts.

The Borrer Executive Search breach is a reminder that professional records you assumed were safely stored can surface without warning. One timely scan and a few concrete steps can break the chain before criminals turn recruitment data into personal harm. Start your DoxxScan trial and put continuous monitoring plus hands-on remediation to work for your entire family.