Empresas Públicas de Medellín listed on ALPHV ransomware leak site

• Ransomware group: ALPHV
• Country: Colombia
• Sector: Energy & Utilities
• Announcement date: July 26, 2023

ALPHV claims data breach at Empresas Públicas de Medellín

The ALPHV ransomware group has listed Empresas Públicas de Medellín on its leak site, claiming to possess the organization's data. This announcement, which appeared on the group's platform, indicates a potential data breach involving the Colombian multi-utility provider. While the listing serves as a claim by the threat actor, it highlights the ongoing risks faced by critical infrastructure providers in the energy and utilities sector.

Details of the alleged event

The ALPHV group, also known as BlackCat, has published an announcement regarding Empresas Públicas de Medellín, threatening to release data belonging to the organization. According to the group, this claim is associated with an event that allegedly occurred on December 26, 2022. The announcement was officially posted on the group's leak site on July 26, 2023.

In support of their claim, the group has shared several document samples that purportedly belong to the organization. These samples are intended to demonstrate the validity of the breach to the public and the victim. No information was provided regarding the total size of the data stolen or the specific number of files compromised. Additionally, no information was provided regarding a ransom demand or the specific circumstances of the initial intrusion.

Types of data involved

Based on the screenshots provided in the announcement, the leaked content includes various types of corporate documentation. The samples shared by the group suggest that the breach involves sensitive administrative and technical information. The identified document types include:

• Tax forms
• Confidentiality agreements
• Technical test protocols
• Project reports

About Empresas Públicas de Medellín

Empresas Públicas de Medellín (EPM) is a multi-utility company based in Medellin, Colombia. The organization is responsible for providing essential services, including water, sewerage, electricity, and natural gas. As one of the largest public entities in the region, EPM plays a critical role in meeting the essential infrastructure needs of its service area.

Risk assessment and industry implications

This alleged leak may pose a risk of exposing the organization's operational data and contracts with third parties. The nature of the shared documents, which include technical protocols and confidentiality agreements, could potentially facilitate identity theft or targeted phishing attacks against employees and business partners. Furthermore, the organization may face legal obligations under Colombian data protection regulations due to the potential exposure of sensitive information.

The ALPHV group is recognized as a Ransomware-as-a-Service (RaaS) provider that was developed in Rust and emerged in late 2021. It is worth noting that the group was subject to law enforcement action in December 2023 and reportedly ceased operations in March 2024. Despite the group's reported cessation, the threat of historical data leaks remains a significant concern for organizations.

Such leaks can cause significant damage to an organization's reputation and can have negative implications for supply chain security. In the energy and utilities sector, where service continuity is vital, data breaches can undermine trust with the public and partners. Organizations in this sector often implement defensive measures such as network segmentation, multi-factor authentication, and rigorous monitoring of administrative access to mitigate the risk of such incidents. These breaches often involve double extortion tactics, where attackers not only encrypt systems but also threaten to release sensitive data to increase pressure on the victim.