https://www.tongapower.to/ Listed by INC Ransom Ransomware Group

On August 21, 2025, the Tonga Power Limited customer and operational data appeared on the leak site of the ransomware group known as Incransom. The state-owned electricity provider for the Kingdom of Tonga, which supplies power to commercial and domestic customers across Tongatapu, Vava‘u, Ha‘apai and ‘Eua, had internal files exfiltrated during a ransomware attack.

What Public Reporting Shows

Public reporting indicates that Tonga Power Limited, established in July 2008 as the concessionaire for Tonga’s electricity regulation regime, suffered a ransomware intrusion that led to the theft of internal documents. The data was later published on the Incransom leak site hosted on the dark web. Available reporting describes the exposed material as internal files; the exact volume and full list of record types remain unconfirmed by the company in public statements. No specific victim count has been released, and Tonga Power has not yet issued a detailed breach notification to affected customers.

August 21, 2025 marks the date the files were listed for public download on the ransomware group’s blog. The incident follows the typical Incransom pattern of exfiltrating data before encrypting systems and then threatening to publish it unless a ransom is paid.

Why This Matters for You and Your Family

If you or anyone in your household receives electricity from Tonga Power, your personal information may now sit in a publicly accessible ransomware repository. Utility companies hold names, addresses, phone numbers, account numbers, payment histories, and sometimes national identification details. Once that information leaves the company’s control, it can be combined with other leaks to build a detailed profile of your daily life, location, and financial habits. For families in Tonga or with relatives there, the breach creates a direct pathway for scams, impersonation, or targeted harassment that can affect everyone sharing the same service address.

Utility customer records are especially valuable to criminals because they tie real-world addresses to names and contact details that many people assume are private. When this data surfaces on a ransomware leak site, the clock starts ticking on how quickly it spreads across criminal marketplaces.

The Doxxing and Identity-Chain Implications

A single utility breach rarely stays isolated. Criminals use leaked addresses, phone numbers, and account details as anchors to link gaming usernames, email addresses, social-media handles, and family members’ records. This creates an identity chain that can expose children’s gaming accounts, shared family emails, and even school-related logins. What begins as a power-bill leak can cascade into full doxxing, account takeovers, and extortion attempts months later when the information has been enriched with data from other sources.

Credential leaks of this kind frequently lead to gaming account compromises because the same email or password reused for a utility portal is often reused for Steam, Roblox, Fortnite, or other platforms popular with children. Once an attacker controls a child’s gaming account tied to a real home address, the risk of harassment and further data extortion grows rapidly.

Incransom’s Publicly Known Track Record

Public reporting attributes Incransom with emerging in late 2024 as a ransomware operation that combines double-extortion tactics with selective data leaks. The group has targeted hospitals, local governments, and critical infrastructure providers in multiple countries. Its typical playbook involves initial access through phishing or exploited remote desktop services, followed by claimed exfiltration of sensitive files, deployment of ransomware to encrypt systems, and then publication of samples on its leak site when victims refuse to pay. Notable prior victims include smaller healthcare providers and municipal utilities, though exact details remain limited in open sources. The group’s leak site continues to publish new victims on a regular schedule, indicating an active and ongoing campaign.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, addresses from the Tonga Power breach, and any connected online handles.
• Rotate the password used at Tonga Power anywhere it is reused, and switch on 2FA using an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your family’s data is caught in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that can chain back to the same utility records.
• Let remediation specialists handle takedown requests and broker removals for any personal information already circulating from this incident.

The Tonga Power breach is a reminder that even essential services can expose your family to long-term risk once data leaves protected systems. Acting quickly on credential hygiene and identity mapping limits how far criminals can travel down the chain that begins with a utility bill. DoxxScan by GalaxyWarden delivers that continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage including children’s gaming accounts.