ende.bo Listed by lockbit5 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 04, 2025, the organisation ende.bo was listed by the ransomware group lockbit5. Public reporting indicates that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and further operational details have not been disclosed.

ende.bo is identified as the National Electricity Company (ENDE), a corporation of the Plurinational State. A listing of this kind raises questions about the security of systems that support national electricity infrastructure and the potential exposure of internal organisational material.

Breaking down the breach

According to available records, ende.bo appeared on a lockbit5 listing dated April 04, 2025. The reported summary states that internal files were exfiltrated in a ransomware attack. No confirmed figures have been released for the volume of data taken, the precise date of initial access, the encryption status of systems, or any ransom demand. The number of people affected is listed as unknown. Public detail on the intrusion method, duration of access, or recovery steps taken by the organisation is limited.

The listing itself constitutes a claim by the group rather than independent verification of every asserted detail. At present, the core confirmed elements are the organisation name, the reporting date, the attribution to lockbit5, and the description of internal files as having been exfiltrated.

The group behind it: lockbit5

lockbit5 is associated with the broader LockBit ransomware operation, a well-documented ransomware-as-a-service enterprise that has been active for several years. Groups operating under this banner typically gain access to networks, move laterally, exfiltrate data, and then encrypt systems while threatening to publish stolen material on dedicated leak sites if payment is not made. This double-extortion model has been observed across numerous prior incidents involving public-sector and critical-infrastructure targets.

LockBit affiliates have historically advertised victims on dark-web leak sites, sometimes releasing sample files to pressure organisations. The group has faced law-enforcement disruption campaigns in recent years, yet variants and rebranded activity have continued to appear. In this case, the listing of ende.bo is presented as a claim by lockbit5; no independent confirmation of the full scope of the claimed exfiltration has been supplied in the public record beyond the facts already noted.

About ende.bo

ende.bo refers to the National Electricity Company (ENDE), a state-linked corporation responsible for electricity generation, transmission and related services within the Plurinational State of Bolivia. Organisations of this type typically manage operational technology, corporate administrative systems, employee records, contractor information, technical documentation, and communications with government bodies and industrial partners.

A breach affecting a national electricity company is consequential because the sector underpins essential public services. Disruption or data exposure can affect operational continuity, commercial relationships and the privacy of individuals whose information is held in corporate systems. Even when the precise impact remains unconfirmed, the strategic nature of the organisation elevates the significance of any reported ransomware incident.

The information in question

The facts name the exposed material as “Internal files exfiltrated in ransomware attack.” No further breakdown of file categories, document types or personal-data fields has been disclosed. Exact contents therefore remain unconfirmed.

Organisations in the electricity sector commonly hold a range of internal material: technical schematics and operational procedures, employee and contractor personal data, financial and procurement records, correspondence with regulators, and system-configuration information. Whether any of these categories were among the files claimed by lockbit5 cannot be established from the public record. Readers should treat the precise nature of the data as unknown until verified by the organisation or independent investigators.

What's at stake

For individuals whose data may have been held by ende.bo, the primary risks include potential misuse of personal or professional information if it was among the exfiltrated files. This can range from targeted phishing that references internal details to longer-term identity or credential abuse. Because the number of people affected is unknown and the exact data types are not confirmed, the scale of personal impact cannot yet be quantified.

For the organisation itself, stakes include possible operational disruption from ransomware encryption, reputational harm, regulatory scrutiny, and the cost of investigation and remediation. Critical-infrastructure entities also face heightened concern about secondary risks if technical or network-related files were taken. These outcomes remain contingent on the still-undisclosed details of the incident.

If your data was in this claimed breach

If you have a relationship with ende.bo—as an employee, contractor, partner or customer—monitor accounts and communications for unusual activity. Change passwords on any related services, enable multi-factor authentication where available, and treat unsolicited messages that reference the organisation with caution. Consider placing fraud alerts with relevant credit or identity-protection services if you believe sensitive personal data may have been involved.

Because the full contents of the claimed exfiltration remain unconfirmed, practical vigilance is the immediate step. Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. Stay alert for official statements from the organisation that may clarify the scope of affected material.

AICompiled with AI assistance from public sources and published under our editorial standards.