thebeautyclick.co.uk Listed by apt73 Ransomware Group

On October 21, 2024, thebeautyclick.co.uk appeared on the leak site operated by the ransomware group known as apt73. The listing states that internal files were exfiltrated during a ransomware attack on the UK-based beauty and hair specialist booking platform founded in April 2018 by Chantelle Bass. The number of people whose data was taken remains unknown, and the leak-site listing does not detail the specific records involved.

Reported Details from the Listing

The apt73 leak page indicates that Beauty Click suffered a ransomware intrusion in which attackers successfully exfiltrated internal files before encrypting systems or demanding payment. No exact volume of records is published, nor does the disclosure specify whether customer booking details, staff payroll information, or supplier contracts were taken. The primary disclosure source, hosted on an onion address and mirrored via ransomware.live, simply lists the company alongside a sample of the allegedly stolen material and a countdown timer typical of extortion campaigns.

October 21, 2024 marks the first public confirmation of the incident through the group’s dedicated leak site. The disclosure follows the standard format used by apt73: company name, proof of compromise, and an implicit threat to publish or sell the data if demands are not met.

Why This Matters for You and Your Family

If you have ever booked a hair appointment, beauty treatment, or training course through thebeautyclick.co.uk, your personal information may now sit in an attacker’s archive. Even though the exact data types are not confirmed, booking platforms routinely hold names, addresses, phone numbers, email addresses, payment references, and sometimes dates of birth or photographic consent forms. Any of these details can be combined with information from other breaches to build a profile that puts you and your family at risk of identity theft, phishing, or unwanted contact. Children’s names or parent contact details occasionally appear in family booking records, extending the exposure beyond the account holder.

Doxxing and Identity-Chain Risks

Stolen internal files from a niche booking service rarely stay isolated. Attackers and subsequent buyers frequently cross-reference email addresses, phone numbers, or usernames against credential-stuffing databases and social-media scrapes. A single leaked booking confirmation that links your email to a child’s name and a salon visit can become the starting point for doxxing chains that surface home addresses, family relationships, and even children’s gaming account handles. Once those connections are mapped, targeted harassment, SIM-swapping attempts, or fraudulent account openings become far easier. The speed with which such data moves between criminal marketplaces means the exposure window is already open.

apt73’s Known Track Record

Public reporting attributes apt73 with emerging in early 2024 as a ransomware and extortion operation that focuses on small-to-medium businesses rather than large enterprises. The group has previously listed dental clinics, local retailers, and professional service firms, typically following a double-extortion playbook: encrypt victim systems, exfiltrate documents, then threaten both decryption refusal and public data release. Their leak site follows a consistent format with countdown timers and sample file proofs. While the exact initial-access methods vary, public reporting on apt73 indicates heavy use of phishing, remote-desktop protocol brute-force attacks, and exploitation of unpatched software on internet-facing servers. The group’s extortion style relies more on steady pressure through gradual data drips than on massive one-time leaks.

What to do

• Rotate any password you used at thebeautyclick.co.uk anywhere else it is reused, and switch on 2FA through an authenticator app rather than SMS.
• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same leaked contact details.
• Let remediation specialists manage data-broker takedown requests and ongoing exposure reduction on your behalf.

The apt73 listing of thebeautyclick.co.uk is a reminder that even small service providers hold data that can fuel larger identity compromises. Acting quickly on credential hygiene and identity mapping limits how far attackers can travel along the chain. DoxxScan by GalaxyWarden delivers that continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes children’s gaming accounts. Start your DoxxScan trial today and close the gaps before the next wave of misuse begins.