FEBANCOLOMBIA Listed by avaddon Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
The FEBANCOLOMBIA Listed by avaddon Ransomware Group (reported September 9, 2021) is an unverified claim; the data involved is undisclosed belonging to roughly unknown people. If you have an account with them, your information may now be circulating on the open web and with data brokers. Here’s exactly what happened, how to check if you were affected, and what to do next.
On September 9, 2021, the ransomware group avaddon listed FEBANCOLOMBIA on its data-leak site. The listing indicated that internal files had been taken from the organization, though the number of people affected and the precise contents of those files remain unknown.
Such listings raise immediate questions for anyone whose information is held by the affected entity. When internal records are removed during a ransomware incident, the material can later appear on public sites or circulate among other actors, creating ongoing exposure that is difficult to quantify at the time of the initial report.
Breaking down the breach
The only confirmed public detail is the appearance of FEBANCOLOMBIA on avaddon’s leak site on the reported date. The group stated that it had exfiltrated internal files during a ransomware operation. No information has been released about the timing of the intrusion itself, the volume of data taken, or whether any material was subsequently published.
Public reporting has not confirmed the scale of the incident or the method used to gain access. The organization has not issued a statement detailing the events, and independent verification of the claimed data removal is not available from the facts on record.
The group behind it: avaddon
Avaddon operated as a ransomware affiliate program that relied on double-extortion tactics. After encrypting systems, the group would copy files and threaten to publish them unless a ransom was paid. It maintained a leak site where victim names were posted when negotiations failed or deadlines passed.
The group’s listings functioned as a public claim of possession rather than independent proof that the data had been released. Avaddon ceased visible operations after law-enforcement actions against its infrastructure in 2021, but archives of its site remain accessible for reference.
About FEBANCOLOMBIA
FEBANCOLOMBIA is an organization operating in Colombia’s financial sector. Entities of this type routinely maintain records that include customer account details, transaction histories, and internal operational documents. Access to such material can affect both individual account holders and the broader functioning of financial services.
A listing involving an organization in this sector draws attention because the data it holds often supports identity verification, credit decisions, and regulatory compliance. Even when the exact files are not disclosed, the nature of the sector means any confirmed exfiltration carries implications for privacy and operational continuity.
The information in question
The available facts state only that internal files were exfiltrated. No inventory of specific data fields, file names, or record counts has been published. It is therefore not possible to determine whether customer records, employee information, or other categories were included.
Organizations in the financial sector commonly store personal identifiers, account numbers, and communication logs. Without confirmation from the incident itself, any description of the contents remains an assumption rather than an established fact.
Why it matters
When internal files are removed, the primary concern is that the material may be used for further criminal activity or shared without the organization’s control. Individuals cannot easily assess their personal exposure when the number of affected people and the data types remain undisclosed.
For the organization, the incident adds to the record of publicly claimed compromises in the financial sector. It also highlights the difficulty of containing data once it has left the original environment, regardless of whether a ransom was paid or files were later published.
If your data was in this claimed breach
Begin by monitoring account statements and credit reports for unusual activity. Change passwords for any financial services linked to the organization and enable multi-factor authentication where available.
Readers can run a free exposure scan of their email address against known breach data to check whether their information appears in publicly referenced incidents. Organizations are expected to provide direct notification if specific records are later confirmed as exposed.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
AXA Group Listed by avaddon Ransomware GroupACER FINANCE Listed by avaddon Ransomware GroupIndonesia Infrastructure Guarantee Fund Listed by avaddon Ransomware GroupUNIVERSAL ACCOUNTING SERVICES INC Listed by avaddon Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the FEBANCOLOMBIA Listed by avaddon Ransomware Group →
Publicly posted by avaddon — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.