FEPCO Zona Franca SAS Listed by knight Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

FEPCO Zona Franca SAS was listed by the ransomware group known as knight on or around 4 February 2024. Public reporting indicates the group claims to have exfiltrated more than 100 GB of internal files during a ransomware attack. The number of people affected remains unknown, and independent confirmation of the full scope of the incident has not been published.

The listing matters because free-zone companies typically handle commercial contracts, financial records and customer information that can be used for fraud or further targeting if exposed. At this stage the claim rests on the group’s own leak-site assertion rather than verified disclosure by the organisation.

Breaking down the breach

According to the available record, FEPCO Zona Franca SAS appeared on knight’s listing on 4 February 2024. The group stated that it had obtained more than 100 GB of confidential data, specifically naming bank contracts, invoices, customer data, company invoices and company receipts. The incident is described as a ransomware attack involving data exfiltration. No further technical details—such as the initial access vector, the exact date of intrusion, encryption status of systems, or any ransom demand—have been publicly disclosed. The number of individuals whose information may have been involved is listed as unknown. Beyond the group’s claim of the data volume and categories, no independent verification of the files or their authenticity has been reported in the source material.

The group behind it: knight

Knight is a ransomware operation that has been observed conducting double-extortion campaigns: encrypting systems while also stealing data and threatening to publish it if payment is not made. Like many contemporary ransomware groups, it maintains a leak site on which it posts victim names and sample data to increase pressure. Public tracking of the group shows it has listed organisations across multiple sectors and regions, typically advertising large volumes of stolen files. In this case the group claims to hold more than 100 GB of FEPCO Zona Franca SAS material; that assertion has not been independently confirmed. No additional statements attributed specifically to this victim beyond the leak-site listing appear in the available facts.

FEPCO Zona Franca SAS and its sector

FEPCO Zona Franca SAS operates within Colombia’s free-trade-zone framework. Free-zone entities generally facilitate manufacturing, logistics, warehousing or commercial services under special customs and tax regimes. Such organisations routinely manage supplier and customer contracts, banking relationships, invoices, receipts and related commercial documentation. Because free zones often serve as hubs for import-export activity, they can hold sensitive financial and operational records belonging both to the company itself and to third parties that use their facilities or services. A breach affecting this type of organisation therefore raises concerns not only for the company but for the broader commercial ecosystem that relies on it.

What data was at risk

The group claims the exfiltrated material consists of internal files that include bank contracts, invoices, customer data, company invoices and company receipts, amounting to more than 100 GB. Exact file inventories, the presence or absence of personal identifiers, and the sensitivity of any individual records remain unconfirmed by independent sources. Organisations of this kind typically store commercial contracts, payment records, customer contact details and internal financial documents. Whether any of those categories actually appear in the claimed archive, and in what volume or form, has not been verified beyond the group’s statement. The precise contents are therefore still unconfirmed.

The real-world impact

If the claimed data are authentic and subsequently circulated, affected parties could face risks of invoice fraud, social-engineering attempts that reference real contracts or receipts, and unauthorised use of customer information. For the organisation itself, the exposure of bank contracts and internal financial documents could complicate banking relationships, invite regulatory scrutiny and require costly remediation and notification efforts. Because the number of people affected is unknown, the scale of individual harm cannot yet be quantified. Even without public release of the files, the mere existence of a ransomware claim can erode commercial trust and impose operational disruption while the company investigates and responds.

Were you affected?

If you have done business with FEPCO Zona Franca SAS or believe your information may have been held by the company, monitor financial statements and watch for unexpected invoices or requests that reference real contracts. Change passwords on any accounts that may have been linked to the organisation and enable multi-factor authentication where available. Consider placing fraud alerts with credit bureaus if you are concerned about identity misuse. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. Official confirmation from FEPCO Zona Franca SAS or relevant authorities should be treated as the primary source for any further guidance.

AICompiled with AI assistance from public sources and published under our editorial standards.