www.certifiedinfosec.com Listed by APT73 Ransomware Group

On December 04, 2024, cybersecurity training provider Certified Information Security (registered trade name of Certified Tech Trainers, D-U-N-S# 010573009) appeared on the leak site of the apt73 ransomware group. The listing states that internal files were exfiltrated during a ransomware attack; the exact number of records affected and the specific data types contained in those files remain unknown because the disclosure does not quantify them.

Details from the Leak-Site Listing

The primary disclosure on the apt73 leak site, accessible via the onion address indexed by ransomware.live, states that Certified Information Security suffered a ransomware intrusion. It states that internal files were successfully exfiltrated prior to any encryption or public posting of samples. No ransom amount, negotiation status, or exact date of initial compromise is published in the listing. The company operates as a provider of information-security training and holds a CAGE code of 3FKS0, facts the listing itself references when identifying the victim.

Internal files exfiltrated is the only description of stolen material supplied by the threat actor. No customer lists, training rosters, payment records, or employee personal data are explicitly named in the public posting, leaving the full scope of exposure unclear at this time.

Why This Matters for You and Your Family

If you or anyone in your household has ever taken a cybersecurity certification course, attended a Certified Information Security training session, or used their services, your name, email address, phone number, or payment details may sit inside the stolen files. Even when exact record counts are not published, ransomware groups routinely harvest any personally identifiable information they encounter. That information can be sold, swapped, or used to launch targeted attacks against you months or years later. For families this risk extends beyond the person who took the course: shared email addresses, family phones, and reused passwords turn one training enrollment into a household exposure.

Doxxing and Identity-Chain Risks

Exfiltrated internal files from a training provider often contain not just names and contact details but also usernames, course completion records, and sometimes notes that link professional identities to personal ones. These fragments become the starting point for doxxing chains. An attacker who obtains your work email from the breach can correlate it with gaming accounts, social-media handles, or family addresses. Once those links are mapped, credential-stuffing attacks, SIM-swapping attempts, and extortion threats become far more effective. Credential leaks like this one frequently cascade into account takeovers on gaming platforms, exposing children’s profiles and turning a corporate breach into a family privacy incident.

apt73’s Known Track Record

Public reporting attributes the apt73 ransomware group with activity that surfaced in 2024. The group has listed a modest but growing number of victims on its dedicated leak site, focusing primarily on small-to-medium businesses and specialized service providers. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by claimed exfiltration of internal documents before deploying ransomware. Rather than always encrypting systems, apt73 often emphasizes data theft and extortion, giving victims a short window to pay before samples or full archives are published. The Certified Information Security listing fits this pattern: internal files exfiltrated, no immediate encryption screenshots posted, and pressure applied through the public leak-site page.

What to do

• Run a DoxxScan to map every link between your emails, phones, handles, and real-world identity so you can see exactly what chains back to the Certified Information Security breach.
• Rotate any password you ever used on Certified Information Security training portals anywhere else it is reused, then enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become the next link in doxxing chains after credential leaks like this one.
• Let remediation specialists handle takedown requests for any exposed personal records that appear on data-broker or extortion sites.

The breach of Certified Information Security underscores how quickly training-provider data can feed larger identity-compromise campaigns. Acting promptly limits how far those stolen internal files can travel. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts vulnerable to credential-based attacks.