EPM Listed by everest Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

EPM, the Colombian public utility known formally as Empresas Públicas de Medellín, has been listed by the everest ransomware group, according to a report dated August 05, 2026. Public detail so far is limited: the listing indicates that internal files were exfiltrated in a ransomware attack, while the number of people affected remains unknown and no further technical specifics have been disclosed.

The claim places one of the region’s largest multi-utility operators under scrutiny. Because EPM supplies electricity, water, sewage, natural gas and telecommunications services to millions of customers in Colombia and beyond, any confirmed exposure of internal material carries potential consequences for both the organisation and the people who rely on it.

Breaking down the breach

What is publicly recorded is straightforward. On or around August 05, 2026, EPM appeared on the leak site associated with the everest ransomware group. The available description states that internal files were exfiltrated during a ransomware attack. No confirmed figure for the volume of data, no list of specific file categories beyond the general label “internal files,” and no timeline of when the intrusion began or how long it lasted have been released in the material at hand.

It is also undisclosed whether the attackers encrypted systems, whether a ransom demand was issued or paid, or whether EPM has independently verified the group’s claims. In short, the incident is known primarily through the group’s listing; independent confirmation of the full scope remains limited.

The group behind it: everest

Everest is a ransomware operation that has been active in the criminal underground for some time. Like many contemporary groups, it is associated with double-extortion tactics: data is stolen before or during encryption, and victims are threatened with public release if payment is not made. The group maintains a leak site on which it names organisations and, in some cases, publishes samples or larger archives of purportedly stolen material.

Public reporting over prior incidents has shown everest targeting a range of sectors and geographies, often focusing on organisations whose disruption or data exposure could create pressure to negotiate. The group’s listings are claims made by the actors themselves; they are not independent verification. In this case, the facts state only that EPM was listed and that internal files were described as exfiltrated. No additional statements attributed to everest about this specific victim appear in the available record.

EPM and its sector

EPM is a major Colombian public-utility enterprise headquartered in Medellín. It operates across energy, water and telecommunications, providing electricity generation and distribution, water supply, sewage services and natural gas. It serves millions of customers inside Colombia and has extended activities into other Latin American countries, positioning it among the largest public-utility groups in the region.

Utilities of this scale sit at the intersection of critical infrastructure and large volumes of operational, commercial and customer-related information. They manage generation and distribution networks, billing and service accounts, engineering and maintenance records, and the administrative systems required to keep essential services running. A breach affecting such an organisation is consequential because the same systems that keep lights on and water flowing also hold data whose compromise can affect service continuity, public trust and the privacy of individuals and businesses that depend on those services.

What data was at risk

The facts name the exposed material only as “internal files exfiltrated in a ransomware attack.” No further breakdown—such as whether customer databases, employee records, financial documents, network diagrams or operational technology data were included—has been provided. The number of people affected is listed as unknown.

Organisations of EPM’s type typically hold a wide range of information: customer account and billing details, employee and contractor records, contracts, engineering plans, SCADA or network-management data, and internal correspondence. Whether any of those categories were among the files claimed by everest is unconfirmed. Until more precise inventories are published by the organisation or by independent investigators, the exact contents of the exfiltrated material remain undisclosed.

Why it matters

For individuals and businesses served by EPM, the primary concern is the possibility that personal or commercial information could later appear in criminal markets or be misused for fraud, social engineering or identity-related crime. Even when the precise data types are unknown, internal files from a large utility can contain enough contextual detail to make phishing or impersonation attempts more convincing.

For the organisation itself, the incident raises questions of operational resilience, regulatory notification duties and the cost of investigation and remediation. Public utilities also face heightened expectations around continuity of essential services; any ransomware event that touches systems supporting electricity, water or gas can create secondary pressures even if core delivery remains intact. Because the scale of impact is still unconfirmed, the practical risk level for any given customer or employee cannot yet be stated with precision—only that the listing itself warrants attention and caution.

Were you affected?

If you are a customer, employee or partner of EPM, treat the situation as a prompt for ordinary hygiene rather than panic. Monitor account statements and utility bills for unfamiliar activity, be sceptical of unexpected messages that claim to come from the company and request personal or payment details, and consider changing passwords on related accounts if you reuse credentials. Keep official contact channels in mind so you can verify any notice that appears to originate from EPM.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. That step will not confirm or rule out involvement in this specific incident, but it can surface earlier exposures and help you decide where to strengthen protections.

AICompiled with AI assistance from public sources and published under our editorial standards.