Everest ransomware group claims data leak involving EPM

• Ransomware group: Everest
• Country: Colombia
• Sector: Energy & Utilities
• Announcement date: August 5, 2026

The Everest ransomware group has claimed to have leaked data belonging to the Colombian multinational public utility company EPM. According to an announcement made on the group's leak site, the data is alleged to belong to EPM and its affiliate, CHEC.

The claimed attack and leak event

The threat actor known as Everest has published a database on its leak site that is allegedly linked to EPM and CHEC. The group states that the breach occurred around July 6, 2026, and the announcement was officially posted on the group's platform on August 5, 2026. The group has provided a download link that is claimed to contain the compromised data.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms through a tactic known as double extortion. In these scenarios, attackers not only encrypt an organization's systems to disrupt operations but also exfiltrate sensitive information, threatening to release it publicly if their demands are not met. This method increases the leverage held by the threat actors, as the exposure of stolen data can lead to significant reputational damage and regulatory scrutiny.

The scope of the compromised data

Based on the information provided by the threat actor, the leaked content is specifically related to the organization's data processing and business intelligence tools. According to the screenshots provided by the group, the leak contains data from the analytics ecosystem and Power BI semantic models belonging to both EPM and CHEC. The specific types of data identified include:

• Analytics ecosystem data
• Power BI semantic models

No information was provided regarding the total size of the data, the specific file count, or the amount of the ransom demand requested by the attackers.

About EPM

EPM (Empresas Públicas de Medellín) is a Colombian multinational public utility company. The organization provides essential infrastructure services, including electricity generation, transmission, and distribution, as well as water supply, sewage, and waste management.

Analysis and potential implications

This leak may indicate unauthorized access to EPM's operational processes and strategic data. Given the company's operation in the critical infrastructure sector, there may be a risk that the leaked data could be utilized for secondary attacks or targeted phishing campaigns. Furthermore, the company may face legal obligations under Colombian data protection regulations. The fact that the Everest group is a Russian-speaking entity known for data theft and extortion since 2020 may suggest a significant security concern. It is also possible that the company's supply chain partners could also be negatively impacted by this incident.

For organizations operating in critical infrastructure sectors, such incidents highlight the importance of robust defensive measures. Common defensive steps include implementing strict access controls to sensitive analytics environments, ensuring comprehensive logging and monitoring of data exports, and maintaining rigorous patch management for business intelligence software. Additionally, organizations often focus on securing their supply chain to prevent lateral movement or data exfiltration through third-party connections. Because attackers may use stolen data for subsequent targeted campaigns, maintaining a strong incident response plan and adhering to regional data protection laws are essential components of a modern cybersecurity posture.