Ecuacorriente S.A. Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Ecuacorriente S.A. was listed by thegentlemen ransomware group on November 25, 2025, after internal files were exfiltrated in a ransomware attack. An undisclosed number of people may have been affected; anyone connected to the organisation should review their information and take protective steps.
What happened
The available information indicates that Ecuacorriente S.A. was added to a listing maintained by thegentlemen on or around November 25, 2025. The group claims internal files were taken in a ransomware operation. No further details on the timing of the intrusion, the volume of data, the encryption status of systems, or any ransom demand have been disclosed publicly. Confirmation of the data's authenticity or the extent of any operational impact has not been provided by the company.
Who is thegentlemen?
Thegentlemen is a ransomware actor that maintains an online listing of claimed victims. Groups of this type typically encrypt systems and exfiltrate data before publishing names or samples on leak sites to pressure targets. Public records show similar actors have focused on sectors with high operational continuity requirements, though specific tactics or prior claims tied to this victim are limited to the current listing.
Who is Ecuacorriente S.A.?
Ecuacorriente S.A. is a mining company operating in Ecuador with an annual mineral processing capacity of 20 million tons. It runs the Mirador Copper project and is controlled by China Railway Construction Copper Crown Investment Co., Ltd. The company reports revenue of approximately 1.11 billion USD and states it has created more than 2,400 direct jobs and over 10,000 indirect jobs in the region. Organisations in this sector routinely manage geological surveys, production records, employee information, and supply-chain documentation.
What was likely exposed
The listing refers to internal files exfiltrated during the attack. The exact categories of data have not been disclosed. Mining companies commonly hold records that include personnel files, operational logs, financial documents, and technical specifications; however, whether any of these specific types were taken in this case remains unconfirmed.
Why it matters
Exposure of internal files from a large-scale mining operation can affect business continuity, regulatory compliance, and relationships with employees and contractors. Where personal information is involved, individuals may face risks of identity misuse or targeted fraud. For the organisation, the incident adds to the administrative and technical workload of assessing and containing any downstream effects.
Were you affected?
Individuals who have had contact with Ecuacorriente S.A. through employment, contracting, or other business dealings should monitor their accounts for unusual activity. A practical first step is to review recent statements from the company and change passwords for any associated services. Readers can also run a free exposure scan of their email address against known breach data to check for prior appearances in public listings.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Complexul Energetic Oltenia Listed by thegentlemen Ransomware GroupSolumek Listed by thegentlemen Ransomware GroupKosmos Listed by thegentlemen Ransomware GroupMBT Energy Listed by thegentlemen Ransomware GroupLatest breaches
Publicly posted by thegentlemen — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.