ZESA Holdings Listed by everest Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who work with or rely on Zimbabwe’s main electricity provider may now face questions about whether their personal, financial or operational information was caught up in a claimed cyber incident. On 8 August 2023 the ransomware group everest listed ZESA Holdings on its leak site, asserting that it had attacked the organisation’s servers and removed large volumes of internal data. The number of individuals affected remains unknown, and independent confirmation of the full scope is limited, yet the claim alone raises practical concerns for employees, contractors, partners and anyone whose details sit inside utility systems.

Because ZESA Holdings sits at the centre of national power generation and distribution, any unauthorised access to its infrastructure carries consequences that extend beyond the company itself. What follows is a factual account of what has been publicly reported, what remains undisclosed, and the concrete steps people can take to protect themselves.

Inside the incident

According to the listing published by the everest group on 8 August 2023, the servers of the entire infrastructure of ZESA Holdings were attacked. The group claimed the intrusion reached multiple divisions, naming ZETDC, ZENT, Powertel, ICS, IPMP and Smartvend, together with various Oracle servers. It further stated that a large part of the organisation’s backups were also attacked and that terabytes of internal data had been exfiltrated to the group’s own servers.

The same listing asserted that the stolen material included internal financial data, among it World Bank data and Indian Bank transactions and documents, along with other unspecified internal files. Public detail beyond this claim is limited. No independent verification of the volume of data, the precise method of entry, or the exact date the intrusion began has been released in the material available. The number of people whose information may have been involved is recorded as unknown. The incident is therefore best understood as a ransomware group’s public assertion of a successful double-extortion attack—data theft paired with encryption—rather than a fully corroborated technical report.

Inside everest

Everest is a ransomware operation that has been active for several years and follows the now-common double-extortion model. After gaining access to a network, the group typically exfiltrates data before encrypting systems, then threatens to publish the stolen material on a dedicated leak site if a ransom is not paid. Listings on that site serve both as pressure on the victim and as advertising to other potential targets.

Public reporting on everest has documented its use of phishing, exploitation of remote-access services and living-off-the-land techniques to move laterally once inside a network. The group has previously claimed responsibility for attacks on organisations across multiple sectors and geographies. In the present case, the only specific assertions about ZESA Holdings are those contained in the leak-site entry itself; no additional statements from the group beyond that listing are part of the recorded facts. As with any such claim, the listing should be treated as an unverified assertion until corroborated by the victim organisation or independent investigators.

Who is ZESA Holdings?

ZESA Holdings is the principal electricity utility in Zimbabwe, responsible for the bulk of the country’s power generation, transmission and distribution. Its subsidiaries and divisions handle generation, the national grid, telecommunications services linked to the power network, and customer-facing systems such as smart metering and vending. Organisations of this type routinely maintain extensive records of employees, contractors, industrial partners, financial transactions with development banks and commercial lenders, technical schematics, and customer account data.

A breach affecting a national utility is consequential because the same systems that keep the lights on also store sensitive commercial and personal information. Disruption or exposure can affect not only day-to-day operations but also the trust of international lenders, suppliers and the public that depends on reliable electricity. The everest listing specifically described ZESA Holdings as accounting for roughly 90 percent of the country’s electricity manufacture, underscoring the organisation’s central role.

What data was at risk

The facts name the exposed material only in general terms: internal files exfiltrated in a ransomware attack. The group’s own summary claimed terabytes of internal data, including internal financial data that allegedly encompassed World Bank data and Indian Bank transactions and documents, together with other unspecified material drawn from the attacked divisions and Oracle servers.

Exact contents remain unconfirmed by any source other than the leak-site claim. Organisations in the electricity sector typically hold employee records, payroll and pension information, contractor and supplier contracts, network diagrams, customer billing databases, and correspondence with financial institutions. Whether any of those categories were in fact taken cannot be stated as established fact on the basis of the available record. The prudent working assumption is that internal operational and financial files were the primary target, while the presence or absence of ordinary personal data belonging to members of the public is simply not known.

What's at stake

For individuals whose information may have been among the exfiltrated files, the practical risks include possible misuse of financial or identity details, targeted phishing that references genuine internal documents, and longer-term exposure if the data is later sold or re-leaked. Employees and contractors could face credential stuffing or social-engineering attempts that exploit knowledge of internal systems. Partners and banks named in the financial documents could see sensitive commercial terms or transaction histories circulated.

For ZESA Holdings itself the stakes include operational disruption if systems remained encrypted, reputational damage with lenders and the public, potential regulatory scrutiny, and the cost of investigation, remediation and any required notifications. Because the organisation underpins national electricity supply, even temporary loss of access to backups or control systems carries wider economic and social consequences. None of these outcomes is confirmed; they are the ordinary, concrete risks that follow when a ransomware group claims to have removed internal data from a critical-infrastructure operator.

Were you affected?

If you are a current or former employee, contractor, supplier or customer of ZESA Holdings or its named divisions, treat the possibility of exposure seriously until more definitive information appears. Change passwords on any accounts that may have been linked to work email or systems, enable multi-factor authentication wherever it is offered, and watch for unexpected financial activity or highly targeted messages that reference internal projects or banking relationships. Keep copies of important correspondence in case you later need to demonstrate that your data was involved.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. That step will not confirm or rule out involvement in this specific incident, but it provides a practical starting point for understanding your wider digital exposure and deciding what further monitoring is warranted.

AICompiled with AI assistance from public sources and published under our editorial standards.