EPM Listed by Everest Ransomware Group

On August 05, 2026, the Everest ransomware group listed Colombian public utility company EPM (Empresas Públicas de Medellín) on its leak site, claiming the organization was hit by a ransomware attack and that internal files had been exfiltrated. The listing does not specify the volume or exact nature of the data taken, nor has EPM issued a public confirmation of the incident as of this writing. This makes the claim an unconfirmed ransomware allegation rather than an established breach notification.

Details from the Leak-Site Listing

The Everest leak site entry states that internal files were exfiltrated during a ransomware attack on EPM. No customer record count is provided, and the listing does not detail specific data types such as names, addresses, national ID numbers, billing records, or payment information. The group has not published any sample files publicly at the time of analysis. Because the sole primary source is the threat actor’s own leak page (tracked via ransomware.live), the incident remains an unconfirmed claim. EPM has not released a customer notification or regulatory filing acknowledging the event.

Why This Matters for You and Your Family

EPM provides electricity, water, sewage, natural gas, and telecommunications services to millions of households across Colombia and parts of Latin America. If your household is an EPM customer, your personal data may be among the internal files the group claims to have taken. A utility company holds sensitive details including names, service addresses, national identification numbers, billing history, contact information, and potentially bank account or payment data. Even without exact numbers, the scale of EPM’s customer base means the potential exposure touches a significant portion of the Colombian population. Until EPM confirms or denies the claim, treating the listing as a credible risk is the safest approach for protecting your family.

Doxxing and Identity-Chain Risks

Utility records are high-value for doxxing because they directly link real names, home addresses, and phone numbers. Once an address is exposed, it can be chained with children’s gaming accounts, school records, or social-media profiles to build a complete family picture. Credential material or internal emails allegedly taken from EPM could also lead to account takeovers that reveal even more personal data. Public reporting on similar utility breaches shows these incidents frequently result in targeted phishing, identity theft, and physical risks when home addresses are published. Children’s gaming accounts tied to a family address are particularly vulnerable because a single leaked credential can cascade into full doxxing chains.

Everest Ransomware Group Track Record

Public reporting attributes the Everest ransomware group with operations dating back to at least 2021. The group is known for double-extortion tactics: encrypting victim systems while simultaneously exfiltrating data for later public release if ransom demands are not met. Everest has previously targeted organizations across healthcare, education, manufacturing, and critical infrastructure sectors. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by lateral movement, data theft, and deployment of ransomware. The group maintains an active leak site where it posts victim names and, in many cases, proof files or stolen data samples. As with most ransomware operations, Everest’s claims are made public to pressure victims, even when the targeted organization has not yet acknowledged the incident.

What to do

• Run a DoxxScan to map every link between your email addresses, phone numbers, handles, and real-world identity, then use the cleanup options available.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so any future exposure tied to EPM or similar services is detected within hours rather than months.
• Rotate any passwords you have reused with EPM systems or related vendor portals and switch to 2FA using an authenticator app instead of SMS.
• Let remediation specialists handle takedown requests for any personal records that surface on data-broker or people-search sites connected to this incident.
• Note that a leaked home address from a utility provider like EPM puts every person living at that location at risk; your own timely removal requests are what remove that address from public circulation.

The Everest listing of EPM underscores how even large regional utilities remain targets and how quickly personal data from essential service providers can reach extortion groups. Treating the claim seriously now gives you time to lock down your exposure before any data appears elsewhere. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion breach records and 100+ platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists—tools that help ordinary families interrupt these doxxing chains before they escalate.