Empresas Públicas de Medellín Listed by alphv Ransomware Group

On December 26, 2022, Colombian public utility Empresas Públicas de Medellín (EPM) appeared on the leak site of the alphv ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the organization that provides water, sewerage, electricity, and gas services to hundreds of thousands of households across Colombia.

Details from the Leak-Site Listing

The alphv leak site entry, still accessible via its onion address as of the initial publication, claims that EPM’s internal documents were taken after the company apparently declined to pay a ransom. The disclosure does not quantify how many records were affected, nor does it list specific data types beyond “internal files.” It does not provide samples or detail whether customer personal information, employee records, or operational data were included. The listing simply states that data was exfiltrated and warns of impending publication if demands are not met. Public reporting on alphv’s operational style indicates the group often follows this pattern of initial access, data theft, and public pressure through their dedicated leak portal.

Why This Matters for You and Your Family

If you or anyone in your household receives electricity, water, gas, or sewerage service from EPM, your personal details may sit inside the compromised internal systems. Utility companies routinely store names, addresses, national identification numbers, service account numbers, payment histories, and contact information. Even when exact record counts remain unknown, the exposure of such data creates immediate risks of identity theft, targeted phishing, and financial fraud. For families in the Medellín metropolitan area and surrounding regions served by EPM, this claimed breach represents a direct threat to the most basic household records many people assume are safely locked away.

Internal files exfiltrated in a ransomware incident almost always contain spreadsheets, databases, or scanned documents that link real people to real addresses and account numbers. Once that combination leaves the company’s control, it travels quickly through underground markets and can be used to build convincing social-engineering attacks against you or your relatives.

The Doxxing and Identity-Chain Risks

Utility breaches rarely stay isolated. The address tied to your EPM account often matches the address on your national ID, tax records, banking profiles, and children’s school registrations. Attackers chain these data points together, turning one leaked utility record into a full identity profile. This is exactly how doxxing campaigns begin: a single credible address and service number gives criminals the confidence to impersonate you to banks, government agencies, or family members. Gaming accounts belonging to children or teenagers frequently reuse the same email addresses or passwords that appear in household utility records, creating an easy path from corporate breach to personal account takeover.

Alphv’s Publicly Known Track Record

Public reporting attributes the alphv ransomware group, also known as BlackCat, with emerging in late 2021. The gang has since targeted healthcare providers, municipalities, technology firms, and critical infrastructure operators across multiple continents. Their typical playbook involves gaining initial access through phishing, remote-desktop vulnerabilities, or stolen credentials, followed by extensive internal reconnaissance, data exfiltration, and then dual extortion: demanding payment both to decrypt systems and to prevent publication of stolen files. The group is known for operating a professional leak site that updates in near real time and for aggressively publicizing victims who refuse to negotiate. The EPM listing fits this established pattern.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, including any connections that may stem from this utility breach.
• Rotate the password used for your EPM online account or any related utility portal anywhere it is reused, and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught and acted on within hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same addresses and emails exposed in utility records.
• Let remediation specialists handle ongoing takedown requests for any personal information already appearing on data-broker or extortion sites.

The EPM breach is a reminder that even large public utilities can become targets, and the data they hold travels farther and faster than most families expect. Starting with a clear picture of where your information already appears online is the most practical defense. DoxxScan’s continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage including children’s gaming accounts give families the ongoing visibility and support needed to close these exposure gaps before criminals exploit them.