EPM Listed by Everest Ransomware Group

On August 05, 2026, the Everest ransomware group listed Colombian public utility giant EPM (Empresas Públicas de Medellín) on its leak site. The company has not, as of this writing, issued any public confirmation or regulatory notification about the incident, making this an unconfirmed claim originating solely from the threat actor’s own platform.

Details from the Leak-Site Listing

The Everest leak site, tracked via Ransomfeed, added EPM on August 5, 2026. The listing does not specify the number of records affected, the exact data types stolen, or any proof-of-compromise samples. It simply names the organization, provides a link to its corporate website (epm.com.co), and indicates that the group claims to have obtained internal data. Because the sole primary source is the ransomware group’s own leak page rather than an official company breach notification or regulator filing, all assertions remain unverified claims by the attackers.

Public utility companies like EPM hold extensive customer databases including names, national identification numbers, service addresses, billing information, contact details, and payment records. The leak-site listing does not detail what was taken, so the precise scope of any potential exposure remains unknown.

Why This Matters for You and Your Family

If you or your family live in the Medellín metropolitan area or anywhere EPM provides electricity, water, sewage, natural gas, or telecommunications services, your personal information may be in the hands of criminals. Millions of Colombian households rely on EPM, meaning the potential scale of impacted individuals is significant even though the exact victim count is unknown.

A compromise at this level can expose the very data criminals need to commit identity theft, file fraudulent tax returns, open accounts in your name, or launch convincing spear-phishing campaigns. Because EPM is a public utility, the breach risk extends beyond individual customers to small businesses and government entities that also rely on its services.

Doxxing and Identity-Chain Risks

Utility records frequently contain home addresses, phone numbers, national ID numbers (cédula de ciudadanía), and account numbers that link directly to real-world identities. Once such data surfaces in criminal circles, it becomes the foundation for doxxing chains: attackers cross-reference the leaked utility data with gaming usernames, social-media handles, email addresses, and breached passwords to build complete profiles.

Children’s gaming accounts are especially vulnerable because parents often reuse credentials or link family devices to the same household address and phone number found in utility records. A single leak can cascade into account takeovers across Steam, Roblox, Discord, and other platforms, exposing minors to harassment, extortion, or further data theft. The identity chain created by these connections can persist for years.

Everest Ransomware Group’s Track Record

Public reporting attributes the Everest ransomware operation to a group that emerged in 2021. The actors are known for double-extortion tactics: they encrypt victim systems and simultaneously exfiltrate sensitive files before threatening to publish the data unless a ransom is paid. Everest has targeted organizations across multiple continents, with previous claims against healthcare providers, manufacturers, and government-adjacent entities. Their typical playbook involves initial access through phishing, remote desktop protocol brute-force, or exploited vulnerabilities, followed by lateral movement, data exfiltration, and publication on their leak site when victims refuse to negotiate. The group continues to evolve its tooling and extortion methods according to open-source threat intelligence.

What to Do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can begin targeted removal of exposed records (no-subscription cleanup included).
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and 100+ platforms so the next time your information appears it is caught within hours rather than months.
• Rotate any password you have ever used with EPM or any of its online customer portals, and secure every reused account with 2FA through an authenticator app instead of SMS.
• Let remediation specialists handle takedown requests across data brokers and exposed databases on your behalf — manual efforts rarely reach all the places criminals sell or repost stolen utility data.
• Note that a leaked home address from a utility breach puts everyone at that location at risk; your own removal actions are what ultimately reduce that address’s visibility in criminal marketplaces.

The incident underscores how even large, essential public-service providers remain targets and how quickly personal data can move from corporate systems into criminal ecosystems. Protecting yourself requires more than hoping the company eventually issues a notice. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion breach records and over 100 platforms, AI-powered identity-chain mapping that reveals how one leak connects to dozens of others, and hands-on remediation by specialists who execute takedowns you cannot realistically manage alone. Acting early limits the damage that follows claims like this one.