Egp Comunicaciones Sac Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Egp Comunicaciones Sac was listed by the Qilin ransomware group on 20 December 2025, indicating that internal files were exfiltrated in a ransomware attack. Individuals should check whether their information was involved and take steps to protect their data.
Inside the incident
The only confirmed public record is the December 20, 2025 listing on the qilin site. The entry asserts that data was exfiltrated, described only as internal files. No additional details on the date of the intrusion, the volume of material taken, the encryption status of systems, or the method of initial access have been disclosed. It remains unconfirmed whether any data has been published or offered for sale beyond the initial listing.
The group behind it: qilin
Qilin is a ransomware operation that has conducted multiple campaigns since at least 2022. Public reporting describes the group as using encryption alongside data theft, a pattern often called double extortion. The actors typically maintain a leak site where they list organizations and, in some cases, release samples or full archives when negotiations fail. The appearance of Egp Comunicaciones Sac on that site constitutes the group’s claim of possession; independent verification of the data’s authenticity or scope has not been made public.
Who is Egp Comunicaciones Sac?
Egp Comunicaciones Sac operates in the communications sector. Organizations of this type commonly manage network infrastructure, customer accounts, billing records, and internal operational systems. A compromise at such a firm can expose both business records and any personal information collected from clients or employees. The current incident is notable because communications providers frequently process data that supports essential services and contains identifying details about large numbers of users.
What data was at risk
The listing refers only to internal files. No inventory of specific file types, databases, or categories of personal information has been released. Organizations in the communications sector routinely hold customer names, contact details, service records, and authentication data; however, whether any of these categories were among the exfiltrated material remains unconfirmed. The exact contents and sensitivity of the files are therefore not established by public information.
Why it matters
Even without a confirmed count of affected individuals, the exposure of internal files from a communications provider can create downstream risks. Personal identifiers or account credentials, if present, could be used for targeted fraud or unauthorized access to other services. For the organization, the incident may affect operational continuity and regulatory obligations regarding data protection. The absence of disclosed details limits precise assessment of harm at this stage.
If your data was in this claimed breach
Monitor financial and online accounts for unusual activity and enable multi-factor authentication where available. Review any recent password resets or unrecognized logins. Individuals can also run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information. Organizations should follow standard incident-response practices, including consultation with legal and technical advisors, even when public details remain limited.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Happy Telecom Listed by qilin Ransomware GroupDon Ricardo Listed by qilin Ransomware GroupTowerstream Listed by qilin Ransomware GroupXOX Mobile Listed by qilin Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Egp Comunicaciones Sac Listed by qilin Ransomware Group →
Publicly posted by qilin — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.