Ransomware Attack on San Siro Stadium: APT73 Claims Responsibility

San Siro Stadium, an iconic sports venue in Milan, Italy, has fallen victim to a ransomware attack by the cybercriminal group APT73. Known for hosting AC Milan and Inter Milan, the stadium is a significant cultural and architectural landmark. Managed by M-I Stadio Srl, the stadium has a seating capacity of 80,018, making it the largest in Italy. The company reported revenues of €27.1 million for the fiscal year ending June 2023, reflecting its importance in the hospitality and sports sectors.

Attack Overview

APT73 has claimed responsibility for the attack, deploying the BASHE Ransomware to exfiltrate 1 TB of sensitive data. The compromised data reportedly includes access to critical systems such as main workstations, control machines for the stadium's giant screens, and personal information of football players. The attackers have also claimed to have obtained UEFA's personal contact details. A countdown of four days has been set by the group, threatening to release the data publicly if their demands are not met. The breach was publicized on the stadium's official website, underscoring the severity of the attack.

About APT73

APT73 is a newly emerged ransomware group that surfaced in April 2024. The group distinguishes itself by adopting the "APT" designation, typically associated with state-sponsored hacking groups, to project a sophisticated image. Their operational model mirrors that of the notorious LockBit group, employing double-extortion strategies. Despite their amateurish signs, such as lacking active mirrors on their data leak site, APT73 has quickly targeted multiple victims across various sectors, including academia and healthcare.

Potential Vulnerabilities

The attack on San Siro Stadium highlights potential vulnerabilities in the hospitality sector, particularly in large venues with complex IT infrastructures. The stadium's reliance on digital systems for operations, including control machines for giant screens and personal data management, may have been exploited by APT73. The group's ability to penetrate these systems suggests a possible lack of effective cybersecurity measures, making such high-profile targets attractive to ransomware groups.