EPS.RS Listed by qilin Ransomware Group

On December 27, 2023, the Serbian state-owned energy giant Electric Power Industry of Serbia (EPS) appeared on the leak site of the qilin ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the company that produces, supplies, and trades most of the electricity used across Serbia. The leak-site entry does not specify the number of records affected or list exact data types beyond “internal files.”

Primary Disclosure Details

The qilin leak site, mirrored on ransomware.live, publicly listed EPS.RS and stated that data had already been stolen from the utility. The disclosure indicates the files were taken as part of a double-extortion operation in which the attackers both encrypt systems and threaten to publish sensitive material unless a ransom is paid. No ransom amount or negotiation status is shown on the listing. The notification does not quantify how many employee, customer, or partner records may have been included in the exfiltrated material.

Why This Matters for You and Your Family

When a national electricity provider is breached, the consequences reach far beyond corporate networks. EPS holds personal and financial details on employees, contractors, and potentially millions of Serbian households that pay their power bills. If those records surface, identity thieves can combine them with other leaks to build complete profiles. Even if you do not live in Serbia, any shared vendors, international partners, or family members connected to the company could expose your information through supply-chain overlap. The breach therefore creates a concrete risk that your address, payment history, or government ID numbers could be traded on criminal forums.

Doxxing and Identity-Chain Implications

Internal files from an energy utility often contain spreadsheets that link employee names, corporate email addresses, phone numbers, and sometimes home addresses. Attackers routinely chain this information with credential leaks from other breaches. A single exposed work email can unlock personal accounts that reuse the same password, leading to full account takeover. Once attackers control an email or phone number, they can reset banking credentials, request new government documents, or impersonate you to family members. Children’s gaming accounts are especially vulnerable in these chains because kids often use a parent’s email or phone for recovery, turning one corporate breach into household-wide exposure.

Qilin’s Publicly Known Track Record

Public reporting attributes the emergence of Qilin (also known as Agenda) to mid-2022. The group has since hit hospitals, manufacturers, and local governments across Europe and North America. Its typical playbook begins with phishing or exploitation of remote-desktop services for initial access, followed by rapid lateral movement, data exfiltration, and deployment of ransomware. Qilin operators usually wait a short period after encryption before publishing samples on their leak site to pressure victims. They have shown willingness to release sensitive operational data rather than simply delete it, increasing the long-term doxxing risk for anyone whose information ends up in the archive.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches you or your family is caught in hours rather than months.
• Rotate any password you used at EPS or any Serbian government-related service and switch on 2FA through an authenticator app instead of SMS.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which frequently chain back to the same addresses and recovery contacts exposed in utility breaches.
• Let remediation specialists handle repeated takedown requests across data brokers and leak sites on your behalf.

The EPS breach is a reminder that even critical national infrastructure remains a target and that one stolen spreadsheet can feed identity theft for years. Start your DoxxScan trial today and combine continuous monitoring, identity-chain mapping, and hands-on specialist remediation to protect yourself and your family before the next wave of leaked files appears for sale. DoxxScan is also effective for protecting gaming accounts because credential leaks like this one routinely cascade into account takeovers and doxxing chains.