INSTITUTO NACIONAL DE ELECTRIFICACION Listed by 8base Ransomware Group

On August 25, 2023, Guatemala’s Instituto Nacional de Electrificación (INDE) appeared on the public leak site operated by the 8base ransomware group. The listing states that internal files were exfiltrated during a ransomware attack against the state-owned electricity authority. The disclosure does not specify the number of records involved or the exact data types beyond “internal files.”

Reported Details from the Listing

The 8base leak page, accessible via the ransomware.live mirror at the onion address provided, lists INDE as a victim and claims successful data exfiltration. The entry carries the date stamp of August 25, 2023. INDE is described in the listing as a decentralized autonomous state entity created in 1959 that oversees electricity generation, transmission, and commercialization functions in Guatemala. No sample files are shown in the public view, and the listing does not quantify affected records or name specific systems compromised. The disclosure indicates the data was taken prior to the public posting; it does not state whether a ransom demand was issued or paid.

Why This Matters for You and Your Family

When a government electricity provider is breached, the consequences reach far beyond corporate networks. Utility customers, contractors, employees, and their families often have personal information stored in the same internal systems used for billing, service requests, and regulatory filings. Even though the exact contents remain undisclosed, internal files from such an agency routinely contain names, addresses, national identification numbers, banking details for direct deposits or payments, and correspondence that can be pieced together for identity theft. If your household receives electricity from the national grid in Guatemala or has interacted with INDE for permits, employment, or vendor services, your information may be among the stolen material.

Doxxing and Identity-Chain Risks

Ransomware operators rarely stop at one dataset. A single leaked government file can link an email address to a physical service address, which in turn connects to social-media handles, children’s school records, or family gaming accounts. These connections create an identity chain that lets attackers or downstream criminals target you for spear-phishing, account takeovers, or extortion. Credential leaks of this nature frequently cascade into gaming platforms where children use the same or similar passwords, exposing family members to doxxing that starts with a utility bill and ends with a public shaming post or swatting attempt. The longer the data sits on a leak site, the more likely it is to be sold or reposted on additional underground forums.

8base’s Known Track Record

Public reporting attributes the first major activity of 8base to early 2022. The group specializes in double-extortion tactics: encrypting victim systems while simultaneously exfiltrating data for later public release if ransom is not paid. Notable prior victims include mid-sized manufacturing, technology, and public-sector organizations across Latin America and the United States. 8base typically gains initial access through compromised remote-desktop credentials or vulnerable web applications, then moves laterally to file servers before exfiltrating documents. Their leak site is used both to pressure victims and to advertise the data to other criminals. The group’s playbook has remained consistent: short negotiation windows followed by data publication on their Tor-hosted portal when demands go unmet.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real-world identity so you can see exactly what chains back to the INDE breach.
• Rotate any password you ever used on government, utility, or email accounts tied to INDE and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the entire household with DoxxScan family protection that extends to dependents and children’s gaming accounts vulnerable to the same credential chains.
• Let DoxxScan remediation specialists manage takedown requests for any exposed personal documents or broker listings that surface from this incident.

The breach of a national electricity authority demonstrates how quickly state infrastructure incidents become personal identity incidents. One set of internal files can fuel months of targeted fraud against ordinary families. Starting with a DoxxScan gives you the clearest picture of your exposure and hands the cleanup work to specialists who monitor continuously and remediate across both dark-web markets and public data-broker ecosystems. Protecting your household today limits what criminals can build from tomorrow’s leak.