Energias de Portugal (EDP) Listed by ragnarlocker Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
The Energias de Portugal (EDP) Listed by ragnarlocker Ransomware Group (reported April 1, 2020) is an unverified claim; the data involved is undisclosed belonging to roughly unknown people. If you have an account with them, your information may now be circulating on the open web and with data brokers. Here’s exactly what happened, how to check if you were affected, and what to do next.
What happened
Public reporting on the incident is limited to the group’s listing. EDP was added to Ragnarlocker’s site on 1 April 2020. The group claims to have exfiltrated internal data during a ransomware attack. No official statement from EDP confirming or denying the claim has been referenced in the available record, and no figure for the volume of data or the number of individuals affected has been disclosed.
Who is ragnarlocker?
Ragnarlocker is a ransomware operator documented in public reporting since 2019. The group typically gains access through remote-desktop services or phishing, deploys encryption on victim systems, and then lists selected victims on a Tor-based leak site when ransom demands are not met. Its listings serve as a pressure tactic, asserting that stolen files will be published unless payment is received. The group’s claims about any specific victim, including EDP, remain unverified outside the listing itself.
Who is Energias de Portugal (EDP)?
EDP is a Portuguese multinational energy company that generates, distributes and supplies electricity and gas across several countries. Utilities of this scale maintain extensive records on residential and commercial customers, including billing information, consumption data, contract details and, in many cases, identification documents required for account opening or regulatory compliance. A breach at such an organisation therefore touches both individual customers and the broader energy infrastructure.
The information in question
The only description provided is “internal files exfiltrated in ransomware attack.” The exact categories of data have not been published. Organisations in the energy sector routinely hold customer names, addresses, tax identifiers, bank or payment details, meter readings and correspondence. Whether any of these data types were among the files listed by the group is unconfirmed.
Why it matters
Exposure of utility records can enable targeted fraud, account takeover or social-engineering attempts against customers. For the company, publication of internal operational files could reveal network configurations or business processes. Because the number of affected individuals and the sensitivity of the files remain unknown, the concrete consequences for any one person cannot yet be quantified from public information.
If your data was in this claimed breach
Monitor bank and utility accounts for unusual activity and consider placing fraud alerts with credit agencies where available. Use strong, unique passwords and enable multi-factor authentication on any service linked to the affected organisation. Readers can run a free exposure scan of their email address against known breach data sets to check whether their information appears in other public listings.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
JMA Energy LEAK Listed by ragnarlocker Ransomware GroupInsignia Environmental company. Listed by ragnarlocker Ransomware GroupLeaks from company EDP Group Listed by ragnarlocker Ransomware GroupBelize Electricity Limited - Leaked Listed by ragnarlocker Ransomware GroupLatest breaches
Publicly posted by ragnarlocker — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.