EPS.RS Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 27 December 2023, the Serbian electricity company EPS.RS appeared on a ransomware group's leak site, with claims that internal files had been taken. For customers, employees and partners whose details may sit inside those systems, the practical concern is straightforward: whether personal or operational information has left the organisation's control and could later be misused.

Public detail remains limited. The number of people affected is unknown, and the exact contents of the files have not been confirmed beyond the broad description of internal material. What is known is that a listing attributed to the Qilin ransomware group asserts that data was exfiltrated during a ransomware attack on the company.

Inside the incident

According to the available record, EPS.RS was listed by the Qilin ransomware group on 27 December 2023. The group claims that internal files were exfiltrated as part of a ransomware attack. No further technical specifics—such as the initial access method, the precise date the intrusion began, the volume of data taken, or any ransom demand—have been publicly disclosed in the facts provided.

The number of individuals potentially affected is listed as unknown. There is no confirmed statement from the company in the given record confirming or denying the claim, nor any independent verification of the files' contents. In short, the incident is known primarily through the group's leak-site listing and the description that internal files were removed during a ransomware event.

The group behind it: qilin

Qilin is a ransomware operation that has been active for several years and is widely documented as operating a ransomware-as-a-service model. Affiliates typically gain access to networks, encrypt systems, and exfiltrate data before demanding payment, a practice known as double extortion. The group maintains a dark-web leak site where it posts victim names and, in some cases, sample files to pressure organisations into paying.

Public reporting has linked Qilin to attacks across multiple sectors and countries. Its operators have historically used common intrusion techniques such as compromised credentials, phishing, or exploitation of exposed remote services, though the specific method used against any single victim is rarely confirmed without forensic detail. In this case, the listing of EPS.RS is a claim by the group; it should be treated as unverified unless independently confirmed. No statements attributed to Qilin beyond the listing itself appear in the available facts.

Who is EPS.RS?

EPS.RS, formally the joint stock company Electric Power Industry of Serbia (Elektroprivreda Srbije), is described as the largest company in Serbia and a central pillar of the country's energy sector. Its main activities are the production, supply and trade of electricity. As a national-scale utility, it operates generation assets, distribution networks and commercial relationships with households, businesses and industrial customers.

Organisations of this type routinely hold large volumes of operational data, customer account information, employee records, supplier contracts and technical documentation related to critical infrastructure. A breach involving such an entity therefore carries weight beyond ordinary commercial data loss: it can affect energy reliability, public trust and the security of systems that keep power flowing to homes and industry.

What data was at risk

The facts state only that internal files were exfiltrated in a ransomware attack. No inventory of specific data types—such as customer names, meter readings, payment details, employee records or network diagrams—has been publicly confirmed. The exact contents therefore remain unconfirmed.

In general, an electricity utility of EPS.RS's scale would be expected to hold customer billing and contact data, employee personal information, technical schematics, operational logs and commercial contracts. Whether any of those categories were among the files claimed by Qilin cannot be established from the available record. Readers should treat any more detailed assertions as speculative until official confirmation appears.

What's at stake

For individuals, the main risks are identity-related misuse if personal details were included, or targeted fraud if account or contact information surfaces later. For the organisation, the stakes include potential disruption to operations, regulatory scrutiny, reputational damage and the cost of investigation and remediation. Because EPS.RS sits at the centre of Serbia's electricity system, any compromise of operational or customer systems also raises broader questions about resilience of essential services.

None of these outcomes is confirmed by the current facts; they are the ordinary consequences that follow when internal files of a major utility are claimed to have left the organisation. The absence of a confirmed headcount or data inventory means the precise scale of harm cannot yet be measured.

What to do if you're exposed

If you are a customer, employee or partner of EPS.RS, treat the situation as a precautionary matter rather than confirmed personal exposure. Monitor bank and utility statements for unexpected activity, be cautious of unsolicited messages that reference your account or the company, and consider changing passwords on any related online services. Enable multi-factor authentication where available.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. That step will not prove or disprove involvement in this specific incident, but it can show whether your address has surfaced elsewhere and help you prioritise further protective measures.

AICompiled with AI assistance from public sources and published under our editorial standards.