ENPPI - HACKED AND MORE THEN 1100 GB DATA LEAKED! Listed by alphv Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

In late November 2022, the Egyptian engineering firm Enppi appeared on a leak site operated by the alphv ransomware group. The listing claimed the company had been hacked and that more than 1,100 GB of data had been taken, with a warning that the material would be published if the organisation did not make contact. Public detail remains limited: the number of people affected is unknown, and independent confirmation of the full scope has not been widely established beyond the group's own claims.

The incident matters because Enppi operates in a sector that routinely handles sensitive technical, commercial and personnel information. Any confirmed exfiltration of internal files raises concrete questions for employees, partners and others whose data may have been among the material the group says it holds.

What happened

According to the alphv listing reported on 27 November 2022, Enppi suffered a ransomware attack in which internal files were exfiltrated. The group asserted that the volume of data exceeded 1,100 GB and threatened publication unless the company contacted them. The listing supplied basic organisational details drawn from public sources, including the company's Cairo headquarters address, website, a general email address and a phone number, along with an approximate revenue figure. No further technical specifics—such as the initial access method, the precise date of intrusion, or forensic confirmation of the claimed data volume—have been disclosed in the available record. The number of individuals affected is listed as unknown.

As with other ransomware leak-site postings, the claims originate with the threat actors themselves and should be treated as unverified until corroborated by the victim organisation or independent investigators. Public reporting at the time did not include an official detailed statement from Enppi confirming or denying the full extent of the alleged breach.

Who is alphv?

Alphv, also widely known as BlackCat, is a ransomware operation that emerged in late 2021 and became one of the more prominent groups in the ransomware-as-a-service ecosystem. It has typically used double-extortion tactics: encrypting systems while also stealing data and threatening to publish it on a dedicated leak site if a ransom is not paid. The group has been observed deploying custom ransomware written in Rust, conducting extensive network reconnaissance, and targeting organisations across multiple sectors and geographies. Its leak site has historically been used both to pressure victims and to advertise successful intrusions.

In this case, alphv's listing of Enppi constitutes a claim by the group that it successfully compromised the company and exfiltrated a large volume of internal files. No additional statements attributed to alphv about this specific victim—beyond the headline assertion of a hack, the claimed data volume, and the demand for contact—are present in the provided facts. Like other ransomware collectives, alphv's public postings are self-serving and require independent verification.

Enppi and its sector

Enppi, formally Engineering for the Petroleum and Process Industries, is an Egyptian company headquartered in Nasr City, Cairo. It provides engineering, procurement and construction services primarily to the oil, gas and process industries. Organisations of this type typically manage detailed project documentation, technical drawings, commercial contracts, supplier and partner information, and internal administrative records, including employee data. The sector is strategically significant in Egypt and the wider region because of its role to energy infrastructure and industrial development.

A breach affecting such a firm is consequential for several reasons. Technical and commercial files can contain proprietary designs or contractual terms whose exposure may create competitive or operational risks. Personnel and partner records, if present, can expose individuals to secondary harms such as phishing or identity misuse. Because energy-related engineering firms often sit within larger supply chains, any compromise can also raise concerns for clients and contractors who share data with the organisation.

The information in question

The available facts state that internal files were exfiltrated in a ransomware attack. No itemised inventory of the specific data types—such as employee records, financial documents, engineering drawings or customer lists—has been publicly confirmed beyond that general description. The alphv listing claimed a volume exceeding 1,100 GB but did not publish a verified catalogue of contents in the material summarised here.

Companies in Enppi's position ordinarily hold a mix of corporate records: human-resources files, internal communications, project and technical documentation, vendor contracts and financial materials. Whether any or all of those categories were among the files the group claims to possess remains unconfirmed. Readers should therefore treat assertions about precise contents as unverified until corroborated by the organisation or by subsequent independent analysis of any released material.

What's at stake

For individuals whose information may have been included, the primary risks are practical rather than abstract. Exposed contact details or identity documents can be reused in targeted phishing or social-engineering attempts. If payroll, national-identity or banking-related data were present—something not established in the public facts—the potential for fraud or account takeover would increase. Even purely internal administrative files can sometimes contain enough personal context to enable convincing impersonation.

For the organisation, the stakes include possible disruption of operations, erosion of trust with clients and partners, regulatory scrutiny under applicable data-protection rules, and the longer-term cost of investigation and remediation. Because the claimed data volume is large, the range of potentially affected parties could extend beyond direct employees to contractors, suppliers and project stakeholders. Until the exact contents are known, the full picture of harm remains incomplete; the prudent assumption is that any sensitive internal material that was accessible to the attackers could now be outside the company's control.

What to do if you're exposed

If you have a past or present connection to Enppi—as an employee, contractor, partner or client—treat the possibility of exposure seriously even while details remain limited. Monitor financial and email accounts for unusual activity, enable multi-factor authentication wherever it is available, and be alert to unexpected messages that reference the company or request sensitive information. Consider placing fraud alerts with relevant credit or identity-protection services if you believe personal identifiers may have been involved. Preserve any suspicious communications rather than deleting them, as they may assist later investigation.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. That step will not confirm or rule out involvement in this specific incident, but it provides a practical starting point for understanding your broader exposure and deciding what further monitoring or credential changes are warranted.

AICompiled with AI assistance from public sources and published under our editorial standards.