www.minex.gob.gt Listed by onyx Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 21 November 2022, the website www.minex.gob.gt appeared on the leak site operated by the onyx ransomware group. The group claims to have stolen internal data from the organisation in a ransomware attack. Public detail remains limited: the number of people affected is unknown, and no independent confirmation of the full scope has been released.

The listing matters because www.minex.gob.gt belongs to a government ministry that handles sensitive diplomatic and citizen-related information. Any confirmed exfiltration of internal files from such an entity raises concrete risks for individuals whose data may have been held and for the continuity of official functions.

Inside the incident

According to the available record, www.minex.gob.gt was listed by the onyx ransomware group on 21 November 2022. The group states that it exfiltrated internal files during a ransomware attack. No further operational details—such as the initial access method, the duration of unauthorised presence, the precise volume of data taken, or any ransom demand—have been disclosed in the public summary.

The number of individuals potentially affected is recorded as unknown. There is no public confirmation that the stolen material has been released in full, partially released, or withheld. The incident is therefore known primarily through the group’s own leak-site claim rather than through a detailed official disclosure or third-party forensic report.

Inside onyx

Onyx is a ransomware operation that has appeared in public reporting as a group that encrypts victim systems and threatens to publish stolen data unless payment is made. Like many contemporary ransomware actors, it has typically relied on double-extortion tactics: data theft followed by encryption, with the leak site used to pressure victims and to advertise claimed successes.

Public documentation of onyx activity describes a pattern of targeting organisations across different sectors and geographies, listing victims on a dedicated site and asserting that internal files have been removed. The group’s claims are not independently verified at the moment of listing; they function as assertions intended to compel negotiation. In this case, the sole concrete statement tied to www.minex.gob.gt is the group’s claim that internal data was stolen. No additional statements attributed specifically to this victim beyond that listing appear in the available facts.

About www.minex.gob.gt

www.minex.gob.gt is the online presence of Guatemala’s Ministry of Foreign Affairs (Ministerio de Relaciones Exteriores). Ministries of this type manage diplomatic relations, consular services, passport and visa processes, and official communications with foreign governments and international bodies. They routinely hold internal administrative records, correspondence, personnel information, and data linked to citizens seeking consular assistance abroad.

A breach affecting such an organisation is consequential because the data it processes often includes identifiers, contact details, and case files that can be sensitive for both officials and private individuals. Disruption or exposure can affect diplomatic operations, citizen services, and trust in official channels. The precise systems involved in this incident have not been publicly detailed.

What data was at risk

The facts state that internal files were exfiltrated in a ransomware attack. No itemised inventory of file types, databases, or record categories has been released. Organisations in the foreign-affairs sector typically maintain internal memoranda, staff records, consular case files, correspondence, and administrative documents. Whether any of those categories were among the material claimed by onyx remains unconfirmed.

Because the exact contents are undisclosed, it is not possible to state with certainty which specific data elements were taken. The only confirmed description is the group’s assertion that internal files were stolen.

The real-world impact

For people whose information may have been held by the ministry, the primary risks are identity misuse, targeted phishing, and unsolicited contact that leverages personal or case-related details. Even limited internal files can contain names, identification numbers, addresses, or correspondence that enable social-engineering attempts. The absence of a confirmed headcount means the scale of individual exposure cannot be quantified from public information.

For the organisation itself, consequences can include operational disruption, the need to review and harden systems, potential reputational damage, and the administrative burden of determining what was taken and notifying relevant parties if required by law or policy. Diplomatic and consular functions rely on confidentiality; any confirmed compromise of internal material can complicate those functions until the scope is clarified.

Were you affected?

If you have interacted with Guatemala’s Ministry of Foreign Affairs—through consular services, passport or visa processes, or official correspondence—consider the following practical steps:

• Monitor official communications from the ministry for any breach notification or guidance.
• Treat unexpected emails, calls, or messages that reference ministry business with caution; verify through official channels before responding or supplying information.
• Review financial and identity accounts for unusual activity and enable stronger authentication where available.
• Change passwords on accounts that may have shared credentials or recovery details linked to ministry-related email addresses.
• Run a free exposure scan of your email address to check whether it has appeared in known breach datasets.

Public detail on this incident remains limited to the November 2022 listing and the group’s claim of internal-file theft. Further clarity would depend on official statements or verified technical reporting that has not yet entered the public record.

AICompiled with AI assistance from public sources and published under our editorial standards.