National Atomic Energy Commission Listed by moneymessage Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target public-sector and critical-infrastructure organisations worldwide, often listing victims on leak sites after claiming to have stolen data. In this landscape, the appearance of a national nuclear agency on such a site raises immediate questions about operational security and the protection of sensitive technical information.

On 18 December 2024 the National Atomic Energy Commission of Argentina was listed by the moneymessage ransomware group. Public reporting states that internal files were exfiltrated in a ransomware attack; the number of people affected remains unknown and further technical details have not been disclosed.

Inside the incident

According to available records, the National Atomic Energy Commission was listed by moneymessage on 18 December 2024. The group’s claim centres on the exfiltration of internal files during a ransomware attack. No confirmed figures for the volume of data taken, the precise date of intrusion, the initial access method, or the number of individuals whose information may have been involved have been made public. Public detail is limited to the listing itself and the description of internal files as the material said to have been removed. Whether any ransom demand was issued, paid, or refused is undisclosed.

The group behind it: moneymessage

Moneymessage is a ransomware operation that follows the now-common double-extortion model: encrypting systems while simultaneously copying data and threatening to publish it if payment is not made. Groups of this type typically advertise victims on dedicated leak sites, sometimes releasing sample files to demonstrate possession of the material. Public reporting on moneymessage has documented its use of these tactics against organisations across multiple sectors. In the present case the group claims to have listed the National Atomic Energy Commission and to have exfiltrated internal files; that claim has not been independently verified in the available records and should be treated as an assertion by the actors rather than confirmed fact.

About National Atomic Energy Commission

The National Atomic Energy Commission, known by its Spanish acronym CNEA, is an Argentine government agency established in 1950. It is responsible for the research, development and regulation of nuclear energy for peaceful purposes. Its remit includes oversight of nuclear power plants, medical and industrial applications of nuclear technology, and scientific research programmes. Organisations of this kind routinely hold technical documentation, operational records, personnel information and research data related to nuclear facilities and materials. A breach involving such an agency is therefore consequential because of the dual sensitivity of nuclear-related information and the public-trust role the commission occupies within Argentina’s energy and scientific infrastructure.

What data was at risk

The only data type named in public reporting is “internal files” said to have been exfiltrated. No further inventory—such as employee records, contractor details, technical schematics, medical-application data or research datasets—has been confirmed. Organisations operating in the nuclear sector typically maintain a range of sensitive material, including personnel files, facility plans, regulatory correspondence and scientific results. Because the exact contents of the claimed exfiltration remain unconfirmed, it is not possible to state with certainty which categories of information were taken or whether any personal data of staff, contractors or members of the public were included.

Why it matters

For individuals whose details may appear in internal files, the principal risks are identity misuse, targeted phishing and potential exposure of employment or contact information. For the organisation itself, the loss of internal documents can create operational disruption, regulatory scrutiny and the need to reassess access controls and incident-response procedures. In the nuclear domain, even non-public technical material can carry broader security implications if it reveals facility layouts, safety systems or research programmes. Because the scale of the incident and the precise data involved are unknown, the full extent of these risks cannot yet be quantified; the listing alone, however, signals that sensitive government-held information may have left authorised control.

Were you affected?

If you have ever worked for, contracted with, or supplied services to the National Atomic Energy Commission, monitor financial and email accounts for unusual activity and consider placing fraud alerts with credit-reporting agencies where available. Change passwords on any accounts that may have reused credentials associated with the organisation. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach datasets. Official notifications, if any are issued by the commission or Argentine authorities, should be treated as the authoritative source of further guidance.

AICompiled with AI assistance from public sources and published under our editorial standards.