RansomHub ransomware group lists www.elecgalapagos.com.ec on its leak site

• Ransomware group: RansomHub
• Country: Ecuador
• Sector: Energy & Utilities
• Announcement date: February 21, 2025

The RansomHub ransomware group has listed data allegedly belonging to the Ecuadorian energy company Elecgalapagos on its leak site. This announcement, made on February 21, 2025, follows a period of alleged unauthorized access to the organization's systems.

Details of the alleged breach

According to the claims made by the RansomHub group, the data breach occurred around February 13, 2025. The threat actor asserts that they have successfully exfiltrated a significant dataset from the target organization. This dataset is reported to consist of approximately 78,132 files, with a total volume reaching 69.5 GB.

Ransomware leak sites are frequently used by cybercriminal groups as a tool for public pressure. In many modern ransomware campaigns, actors employ a strategy known as double extortion. In this scenario, attackers do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information before the encryption process begins. The threat actors then threaten to publish this stolen data on public leak sites if the ransom demands are not met, using the threat of reputational damage and regulatory scrutiny as leverage.

Data types involved in the leak

The information allegedly released by the threat actor includes both corporate and personal data. Based on screenshots provided by the group, the leaked content appears to encompass a variety of sensitive documents. The specific categories of affected data include:

• Employee payroll and salary data
• Corporate asset reports
• Technical maintenance documents
• Identification card information

The presence of such diverse data types suggests a deep level of access into the organization's internal file structures, ranging from human resources records to technical operational documentation.

About Elecgalapagos

Elecgalapagos is a public utility company located in Ecuador. It is responsible for providing essential electricity generation, transmission, and distribution services within the Galapagos Islands region. The company plays a critical role in the area by managing the regional energy infrastructure and implementing various sustainable energy solutions to meet the needs of the region.

Risk assessment and implications

The leaked data poses a high risk to the organization and its stakeholders. Because the dataset contains personal information belonging to employees, it could lead to identity theft attempts or highly targeted phishing attacks directed at the staff members. Furthermore, the inclusion of corporate operational details and technical documents could compromise the security and integrity of the energy infrastructure managed by the company.

From a regulatory perspective, the organization may face legal sanctions under the data protection regulations established in Ecuador. Such legal consequences often follow the exposure of sensitive personal and corporate information.

While it has been reported that the RansomHub group ceased its operations in early 2025, the current leak is still anticipated to have negative impacts on the commercial reputation of Elecgalapagos. For organizations operating in the energy and utilities sector, such incidents highlight the importance of robust cybersecurity frameworks. Defensive measures typically include implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized data movement, and conducting regular security audits to identify vulnerabilities in critical infrastructure networks.