Equatorial Coca-Cola Bottling Listed by worldleaks Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Equatorial Coca-Cola Bottling was listed by the worldleaks ransomware group on April 22, 2026, after internal files were exfiltrated in a ransomware attack. An undisclosed number of people may be affected; anyone connected to the organisation should review their data exposure and take appropriate protective steps.
What happened
The listing appeared on April 22, 2026. The only details released publicly state that internal files were exfiltrated during a ransomware attack. No figure for the volume of data, the number of people affected, or the timeline of the intrusion has been disclosed. The organisation has not issued a public statement confirming or denying the claims.
The group behind it: worldleaks
Worldleaks is a ransomware operator that publishes victim names on a dedicated leak site when ransom negotiations fail or to apply additional pressure. The group follows the common double-extortion model of encrypting systems and threatening to release stolen material. Its listings have previously included companies in manufacturing, logistics and consumer-goods sectors. The Equatorial Coca-Cola Bottling entry remains an unverified claim by the group.
Equatorial Coca-Cola Bottling and its sector
Equatorial Coca-Cola Bottling operates as a licensed bottler and distributor of Coca-Cola branded beverages across parts of West and Central Africa, including Cameroon and Equatorial Guinea. The company runs bottling plants and regional distribution networks within the non-alcoholic beverage industry. Such organisations routinely hold production schedules, supplier contracts, logistics records and employee data required to maintain continuous manufacturing and delivery operations.
The information in question
The listing refers only to “internal files exfiltrated in ransomware attack.” No further breakdown of file categories or data fields has been published. Organisations of this type commonly store operational documents, commercial agreements and personnel records, yet the precise contents of any exfiltrated material remain unconfirmed.
The real-world impact
Exposure of internal operational files can create competitive or supply-chain risks for the company and its partners. Where employee or customer records are involved, individuals may face increased chances of targeted phishing or account misuse. No confirmed evidence of subsequent misuse has been reported to date.
If your data was in this claimed breach
Monitor bank and email accounts for unusual activity and enable multi-factor authentication where available. Organisations holding personal data are expected to notify affected individuals under applicable data-protection rules once the scope is established.
- Change passwords for any accounts that may have been linked to the organisation.
- Review recent statements from financial institutions and credit agencies.
- Run a free exposure scan of your email address against known breach repositories.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Centra Sota Cooperative Listed by worldleaks Ransomware GroupBrazilian IT Firm Service IT Breached by WorldLeaksTreet Group of Companies Listed by worldleaks Ransomware GroupStarpool Listed by worldleaks Ransomware GroupLatest breaches
Publicly posted by worldleaks — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.