Empresas Públicas de Medellín Listed by alphv Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Empresas Públicas de Medellín, the major public utilities provider known as EPM, was listed by the alphv ransomware group on or around December 26, 2022. Public reporting indicates that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and further technical details have not been disclosed.

The listing itself is a claim by the threat actor. For customers, employees, and partners of a utility that supplies water, electricity, and gas across a large urban region, any confirmed or claimed compromise of internal systems raises practical questions about what information may have left the organisation and what residual risk remains.

Breaking down the breach

According to available public information, Empresas Públicas de Medellín appeared on the alphv leak site in late December 2022. The reported summary states that internal files were exfiltrated in a ransomware attack. No confirmed figure for the volume of data, no list of specific file names or systems, and no public timeline of initial access or encryption have been released in the material provided. The number of individuals whose information may have been involved is listed as unknown.

Ransomware incidents of this type commonly involve both encryption of systems and theft of data before encryption, a pattern associated with alphv. Beyond the claim of exfiltrated internal files and the December 26, 2022 reporting date, operational details—such as the initial intrusion vector, dwell time, or whether a ransom was demanded or paid—remain undisclosed. The listing should be treated as an unverified assertion by the group unless independently confirmed by the organisation or authorities.

Who is alphv?

Alphv, also widely known as BlackCat, is a ransomware operation that emerged in late 2021 and operated as a ransomware-as-a-service model. Affiliates gained access to victim networks, deployed the ransomware, and shared proceeds with the core developers. The group was notable for using a Rust-based encryptor, supporting multiple operating systems, and routinely practising double extortion: encrypting data while also stealing copies and threatening to publish them on a dedicated leak site if payment was not made.

Alphv claimed numerous high-profile victims across sectors including government, manufacturing, healthcare, and critical infrastructure before law-enforcement actions disrupted parts of its infrastructure in later years. Its public leak site served as both a pressure mechanism and a distribution channel for stolen data. In this case, the appearance of Empresas Públicas de Medellín on that site constitutes the group’s claim; it does not by itself prove the full scope or success of any attack.

About Empresas Públicas de Medellín

Empresas Públicas de Medellín, or EPM E.S.P., is a large multi-utility enterprise based in Medellín, Colombia. Its bylaws in force are set out in Decision 12 of 1998, as amended by Decision 32 of 2006. It operates in the water and sewerage, electricity, and gas sectors and is legally empowered to act in telecommunications and garbage collection as well. As a major public-service provider, it manages critical infrastructure and holds extensive operational, commercial, and customer-related information.

Organisations of this type typically maintain records on service connections, billing, employee data, engineering plans, supplier contracts, and internal administrative files. A breach affecting such an entity is consequential because disruption or data exposure can affect essential services and the personal or financial information of large numbers of residents and businesses that rely on those services.

What was likely exposed

The only data type named in the available facts is “internal files exfiltrated in ransomware attack.” No further breakdown—such as whether the files included customer databases, employee records, financial documents, network diagrams, or credentials—has been publicly detailed in the material at hand. The exact contents therefore remain unconfirmed.

Utilities of EPM’s scale ordinarily hold customer account and billing information, employee and contractor personal data, technical and operational documentation, and commercial contracts. It is reasonable to expect that some combination of these categories could be present among internal files, but that expectation is not the same as confirmed exposure. Until the organisation or independent investigators publish a verified inventory, any assertion about specific data elements would be speculative.

What's at stake

For individuals, the primary risks centre on misuse of any personal or account information that may have been among the stolen files. That can include targeted phishing, identity fraud, or attempts to exploit knowledge of service accounts or payment details. Because the number of people affected is unknown and the precise data types are unconfirmed, the scale of individual harm cannot yet be quantified.

For the organisation, stakes include potential regulatory scrutiny, reputational damage, costs of investigation and remediation, and the possibility that operational or engineering information could assist further attacks if it was taken. Critical-infrastructure operators also face heightened concern that stolen internal material might be used to map systems or social-engineer staff. None of these outcomes is automatic; they depend on what was actually removed and how it is subsequently used.

What to do if you're exposed

If you are a customer, employee, or partner of Empresas Públicas de Medellín, treat the incident as a prompt to review your own exposure rather than as proof that your data was taken. Monitor financial and utility accounts for unexpected activity, enable multi-factor authentication wherever it is offered, and be alert to phishing messages that reference EPM services or claim to relate to a data incident. Consider placing fraud alerts with credit bureaus if you believe sensitive personal identifiers may have been involved.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. That step will not confirm or rule out involvement in this specific incident, but it provides a practical baseline for deciding what further monitoring or credential changes are warranted. Official statements from EPM or Colombian authorities, if and when they are issued, should be treated as the authoritative source for Reported Details.

AICompiled with AI assistance from public sources and published under our editorial standards.