Cyber Incident Victim: Apex America
Date:
May 2021
Location:
United States of America
Summary
Apex America, a Latin American digital customer experience services provider, was targeted by the REvil (Sodinokibi) ransomware group, which demanded a $7 million ransom and later reduced it to $6 million after unsuccessful negotiations. The attackers exfiltrated company data, posting partial proof on their leak site while threatening to sell or publish additional stolen information after the firm ceased communication. Concurrently, internal disputes within REvil emerged publicly, with affiliates "UNKN" and "Signature" accusing each other of mishandling the operation and losing the potential ransom, though their arbitration claims for financial compensation were dismissed by a forum moderator. The incident resulted in potential data exposure and operational disruption for the company.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On or around May 9, 2021, the REvil ransomware group (also known as Sodinokibi) targeted Apex America, a Latin American digital customer experience services company partnering with over 50 global brands. REvil added Apex America to their dedicated leak site, publishing limited screencaps of stolen data as proof of compromise while announcing ongoing analysis of the exfiltrated documents. The group stated some data would be publicly released while other portions would be sold privately, inviting potential buyers to negotiate. Initial ransom demands were set at $7 million. After several days without payment, an individual purportedly representing Apex America engaged REvil in chat negotiations, inquiring about the lowest acceptable amount. REvil reduced the demand to $6 million, but the entity ceased communication following this counteroffer.
Five days after the $6 million offer, REvil’s negotiator publicly noted Apex America’s lack of response, emphasizing their intent to conduct "business, not war." Following this silence, REvil escalated by listing the company on their leak site and increasing the ransom demand. Concurrently, internal disputes emerged within REvil’s operations: affiliates "UNKN" and "Signature" filed reciprocal $7 million lawsuits via a Russian-language forum’s arbitration channel, each accusing the other of undermining the Apex America operation’s profitability. The arbitrator dismissed both claims, citing forum rules against profit-loss disputes and noting both parties assumed partnership risks. Apex America did not acknowledge the incident on its website or social media channels despite direct inquiries from DataBreaches.net, and no containment or remediation actions were disclosed. The incident concluded with REvil retaining an unspecified volume of company data for potential sale or leakage, leaving the full impact on Apex America’s operations and clients unverified in public reporting.