drizly.com Listed by apt73 Ransomware Group

On October 17, 2024, alcohol-delivery platform Drizly.com appeared on the leak site operated by the ransomware group known as apt73. The listing states that internal files were exfiltrated during a ransomware attack and that the data includes databases containing 2,479,145 lines of user information such as dates of birth and device identifiers. The notification does not specify the exact number of unique individuals affected or list every data field involved.

Details from the Leak-Site Listing

The apt73 leak page, accessible via the ransomware.live mirror at the provided onion address, claims the attackers obtained internal files after breaching Drizly’s systems. It explicitly mentions databases of users and references 2,479,145 lines that include dates of birth and device information. The disclosure does not quantify how many distinct customer records exist, nor does it confirm whether payment details, addresses, or government identifiers were taken. No ransom demand figure or negotiation status is published on the listing.

Drizly has not yet issued a public breach notification that adds further detail, so the precise scope remains limited to what the threat actor chose to advertise.

Why This Matters for You and Your Family

If you or anyone in your household has ordered alcohol through Drizly, your personal information may now sit in an attacker-controlled archive. Dates of birth combined with device data and email addresses create straightforward building blocks for identity thieves. Even without full Social Security numbers, attackers can use this information to answer security questions, reset passwords on other accounts, or impersonate you when contacting customer service.

Because Drizly serves alcohol, many customers are adults whose household members—including spouses or older children—may share delivery addresses or payment methods. A single breach can therefore expose patterns that reveal family relationships, home locations, and routines.

The Doxxing and Identity-Chain Risk

Information exposed in this incident does not exist in isolation. Dates of birth and device fingerprints can be correlated with usernames, emails, and phone numbers that appear in earlier breaches. Once linked, these chains allow attackers to locate social-media profiles, gaming accounts, and even children’s online handles that reuse the same password or security answers.

Credential leaks of this type frequently cascade into account takeovers on gaming platforms, where children’s profiles can be hijacked to spread malware or demand further ransom from parents. The public posting on an extortion site increases the chance that multiple criminal groups will download and cross-reference the data, accelerating the speed at which your information travels across underground forums.

Apt73’s Known Track Record

Public reporting attributes apt73 with operating a double-extortion model that combines data theft and encryption. The group first gained attention in early 2024 and has since listed dozens of organizations, many in retail, logistics, and consumer-services sectors. Notable prior victims include mid-sized e-commerce platforms and service providers whose customer databases were later published when ransom demands went unpaid.

Typical playbook involves initial access through compromised credentials or unpatched remote desktop services, followed by exfiltration of internal shares before encryption. The group then waits a short period before publishing samples or full datasets on its leak site, using the public pressure to encourage payment. The Drizly listing follows this pattern exactly.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Rotate the password you used at Drizly anywhere it is reused and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household—DoxxScan family coverage extends to dependents and children’s gaming accounts that often chain back to the same address or reused credentials.
• Let remediation specialists manage takedown requests for any newly surfaced personal records on data-broker and extortion sites.

The incident underscores that even familiar consumer services can become gateways to broader identity compromise once their databases reach ransomware operators. Starting proactive steps now limits how far attackers can travel along the identity chains they are actively building. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.