www.aliorbank.pl Listed by APT73 Ransomware Group

Alior Bank, one of Poland’s major commercial banks, was listed on the leak site of the ransomware group apt73 on December 05, 2024. The listing states that internal files were exfiltrated during a ransomware attack. The amount of data published so far is small — 0.06 GB — but the disclosure indicates that financial documents and other internal records were taken. The number of customers or employees whose information may be exposed remains unknown.

Reported Details from the Listing

The apt73 leak site entry explicitly names www.aliorbank.pl and describes the incident as a ransomware attack in which internal files were allegedly stolen. It states that financial docs and internal docs were exfiltrated. The posted sample is limited to 0.06 GB, and the listing does not detail the total volume of data taken or the exact records involved. No customer record count is provided, and the disclosure does not specify whether account numbers, transaction histories, or personal identification data were included in the full exfiltration. The primary source is the group’s own onion site, archived and indexed by ransomware.live at the URL below.

Why This Matters for You and Your Family

When a bank suffers a ransomware breach, the information at risk often extends beyond corporate files. Even a modest leak of internal documents can contain spreadsheets, scanned forms, or email attachments that list customer names, addresses, tax identifiers, or payment details. If your family holds accounts at Alior Bank or has interacted with the institution for loans, mortgages, or insurance, your personal data may now sit in an attacker-controlled archive. Banks process highly sensitive financial relationships; once those records leave the institution’s control, they become permanent ammunition for identity thieves, loan fraud, and targeted phishing. Ordinary customers and their households bear the real cost when banks cannot keep internal data secure.

The Doxxing and Identity-Chain Risk

Financial documents frequently contain more than numbers. They link names to addresses, phone numbers, email accounts, and sometimes spouse or dependent details. Attackers do not stop at the first leak. They combine the newly exposed data with information already circulating on criminal forums to build complete identity chains. A single leaked bank statement can connect your work email to your home address, your children’s names, and even gaming usernames used by teenagers in the household. These chains allow criminals to hijack online accounts, request password resets across linked services, and ultimately doxx or impersonate family members. Credential leaks of this type routinely cascade into gaming account takeovers because children often reuse simplified passwords or recovery emails that appear in parental financial records.

apt73’s Known Track Record

Public reporting attributes apt73 with operating a double-extortion ransomware program that emerged in 2023. The group is known for targeting mid-sized organizations across Europe and North America, with a focus on companies that possess valuable internal documentation rather than headline-grabbing retail giants. Previous victims listed on their leak site have included manufacturing firms, professional services providers, and financial-adjacent businesses. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by claimed exfiltration of documents before encryption. They then demand payment for both decryption and non-disclosure. When victims refuse to pay, apt73 publishes small proof-of-compromise samples and gradually increases pressure by releasing additional batches. The group’s leak site remains active and continues to list new victims on a regular basis.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, including any connections that may have surfaced from the Alior Bank files.
• Rotate any password you have used at aliorbank.pl or related financial portals anywhere it is reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become the next target when parental financial data leaks.
• Let remediation specialists handle takedown requests for any exposed personal documents or broker listings that appear after this incident.

The incident shows that even regulated financial institutions remain vulnerable to determined ransomware operators who prioritize data theft over immediate encryption. Protecting yourself means assuming your information will appear in future leaks and acting before criminals complete the identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today and close the gaps attackers count on.