Equatorial Energia Listed by Cloak Ransomware Group

Equatorial Energia, a major Brazilian electricity distributor, was listed on the leak site of the cloak ransomware group on March 24, 2024. The listing indicates that internal files were exfiltrated during a ransomware attack, placing customer, employee, and operational data at risk of public release or private sale. Anyone whose information is held by the company — from billing records to employment documents — may now face heightened exposure.

Details from the Leak Site

The primary disclosure on the cloak leak site states that Equatorial Energia suffered a ransomware incident in which attackers successfully exfiltrated internal files. The listing does not quantify the number of affected records, specify exact data types beyond “internal files,” or disclose any ransom demand. It simply states the breach occurred and that stolen data is now under the group’s control. Public reporting on similar cloak listings shows that when victims do not pay, samples or full datasets are often published or auctioned to other criminals.

March 24, 2024 marks the date the company appeared on the leak portal. The disclosure provides no timeline of when the initial intrusion happened or how long the attackers remained inside the network before exfiltrating data.

Why This Matters for You and Your Family

If you or anyone in your household receives electricity from Equatorial Energia in Brazil, your personal information may have been taken. Utility companies routinely store names, addresses, government identification numbers, bank details for autopay, consumption history, and sometimes phone numbers or email addresses. When these records leave the company’s control, they become raw material for identity theft, targeted phishing, or financial fraud against you and your family.

Employees of Equatorial Energia face even more direct risk. Payroll files, tax documents, and HR records frequently appear in these exfiltrations. A single leak can expose your income, national ID, and family member names in one convenient package for criminals.

Doxxing and Identity-Chain Risks

Utility data is particularly dangerous because it links your real-world address and government ID to online handles, email accounts, and phone numbers. Attackers routinely combine these records with other breaches to build complete identity profiles. Once criminals map your home address to your email and phone, they can pursue account takeovers, SIM-swapping, or physical intimidation.

Credential leaks like this one cascade into gaming account takeovers. Children’s usernames, shared family emails, or reused passwords from a parent’s utility portal can give attackers entry into Roblox, Fortnite, or other platforms. From there, the chain often continues: stolen gaming credentials lead to linked social media, which leads to further personal details. The result is a widening doxxing spiral that can affect every member of the household.

The Cloak Ransomware Group’s Track Record

Public reporting attributes cloak as a ransomware operation that emerged in late 2023. The group typically gains initial access through phishing, compromised remote desktop credentials, or exploited vulnerabilities in internet-facing systems. Once inside, they exfiltrate data before deploying encryption, then pivot to extortion by threatening to publish sensitive files unless payment is made.

cloak follows a double-extortion model common among modern ransomware actors: they demand payment to prevent data release and sometimes offer a second payment to obtain a decryptor. Notable prior victims have included organizations across Latin America and Europe, though the group maintains a relatively low public profile compared with larger ransomware brands. Their leak site serves both as a shaming platform and a marketplace for unsold data.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours rather than months.
• Rotate any password you used for Equatorial Energia portals or billing accounts anywhere it has been reused, and switch to 2FA through an authenticator app instead of SMS.
• Cover the entire household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same addresses and emails.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing your own accounts.

The Equatorial Energia breach is a reminder that even routine service providers can become gateways to identity compromise. Taking deliberate steps now limits how far criminals can travel down the chain that begins with your utility bill. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.