INSTITUTO NACIONAL DE ELECTRIFICACION Listed by 8base Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On August 25, 2023, the Instituto Nacional de Electrificación, Guatemala’s national electrification authority, was listed by the ransomware group known as 8base. Public reporting indicates that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and further specifics about the incident have not been disclosed.

The listing places a state electricity entity on a criminal leak site, raising questions about the exposure of operational and administrative material. What is confirmed so far is limited to the group’s claim and the reported nature of the data involved.

Breaking down the breach

According to available information, Instituto Nacional de Electrificación appeared on 8base’s listings on August 25, 2023. The incident is described as a ransomware attack in which internal files were allegedly exfiltrated. No public figure has been given for the volume of data, the number of affected individuals, or the precise timeline of intrusion and encryption. Methods of initial access, dwell time, and whether a ransom demand was issued or paid are undisclosed. The record states only that internal files were taken during the attack and that the organisation was listed by the group. Beyond that claim and the reported data category, verified detail remains limited.

The group behind it: 8base

8base is a ransomware operation that emerged into wider public view in 2022 and 2023. Like many contemporary groups, it has typically relied on double-extortion tactics: encrypting systems while also copying data and threatening to publish it if payment is not made. The group has maintained a leak site where it names victims and, in some cases, releases samples or fuller archives. Its activity has been documented across multiple sectors and countries, often targeting organisations whose disruption carries operational or reputational cost. In this instance, 8base’s listing of Instituto Nacional de Electrificación constitutes the group’s claim; independent confirmation of the full scope of the intrusion has not been supplied in the public record summarised here. No statements attributed to 8base beyond the act of listing are included in the available facts.

INSTITUTO NACIONAL DE ELECTRIFICACION and its sector

Instituto Nacional de Electrificación, commonly known as INDE, is a Guatemalan state, autonomous and decentralised entity created on May 27, 1959, under Decree 1,287 of the Congress of the Republic. It operates under its Organic Law (Decree 64-94) and the General Electricity Law, which separated functions among generation, transmission and control, and commercialisation entities. INDE holds functional autonomy, its own assets, legal personality, and the capacity to acquire rights and contract obligations within its competence. As the national electrification institute, it sits at the centre of electricity infrastructure planning, generation-related activity, and related public administration.

Organisations in this sector routinely manage technical plans, grid and generation data, contracts, employee and contractor records, financial and procurement files, and correspondence with other state bodies. A breach affecting such an entity matters because electricity infrastructure underpins daily life, industry, and public services; compromise of internal material can affect operational continuity, commercial negotiations, and public trust in essential services. The consequences extend beyond the organisation itself to citizens and businesses that depend on stable power systems and transparent administration of the sector.

The information in question

The facts name the exposed material as internal files exfiltrated in a ransomware attack. No further breakdown—such as whether the files included personal data, technical schematics, financial records, or employee information—has been publicly detailed in the material provided. Exact contents therefore remain unconfirmed.

Entities of this type typically hold a mix of administrative, technical, and personnel-related information: staff and contractor details, internal memoranda, project documentation, supplier contracts, and operational data tied to generation and transmission functions. It is not established which of these, if any, were among the files taken. Readers should treat any specific claims about data categories beyond “internal files” as unverified unless corroborated by the organisation or independent investigation.

What's at stake

For individuals whose information may have been present in internal files, risks include potential misuse of personal or contact details, targeted phishing that references genuine organisational context, and longer-term exposure if material circulates further. Because the scale of affected people is unknown, the practical impact on any given person cannot yet be measured.

For the organisation, stakes include possible disruption to administrative and technical processes, the cost of incident response and system recovery, scrutiny of how sensitive internal material is protected, and reputational effects that can complicate relations with partners, regulators, and the public. In the electricity sector, even limited exposure of operational or contractual files can create secondary risks if adversaries gain insight into infrastructure or commercial arrangements. None of these outcomes is confirmed as having materialised at a specific scale; they represent the concrete categories of harm that follow from ransomware incidents involving exfiltration of internal files.

Were you affected?

If you have a past or present connection to Instituto Nacional de Electrificación—as an employee, contractor, supplier, or correspondent—monitor account statements and official communications for unusual activity, and treat unsolicited messages that reference the organisation with caution. Change passwords on related accounts where appropriate and enable multi-factor authentication where it is available. Because the number of people affected and the precise data types remain undisclosed, there is no public list against which to check a name directly. You can run a free exposure scan of your email address to see whether it has appeared in known breach datasets, which may provide an additional signal if your information has circulated more widely. For definitive guidance, rely on any official notices issued by the institute itself.

AICompiled with AI assistance from public sources and published under our editorial standards.