Emperador group claims EVNHANOI data breach

A ransomware/extortion group calling itself Emperador claims to have leaked 300GB of Vietnam Electricity (EVNHANOI) customer data.

Ransomware.live's leak-site tracker recorded a listing attributed to a group identified as "Emperador" claiming to hold approximately 300GB of data allegedly exfiltrated from EVNHANOI, a regional distribution subsidiary of Vietnam Electricity (EVN), the country's sole state-owned national power utility. The claimed dataset reportedly includes 13.36 million rows of customer details, 6.99 million subscription records, and 2.26 million account records, along with other miscellaneous data. The listing includes a negotiation session identifier and a Tox messaging ID, consistent with typical extortion-site postings used to facilitate ransom negotiations or data sale.

As EVN is Vietnam's sole vertically-integrated national electric utility and a critical infrastructure operator central to grid digitalization and the country's energy transition, any confirmed compromise of customer or account data could have significant privacy and operational-trust implications. However, this entry is a leak-site claim indexed from a ransomware tracking site rather than a vendor-confirmed intrusion report; no technical details on the initial access vector, malware used, or lateral movement have been disclosed, and there is no independent confirmation of the breach's authenticity or scope at this time. Defenders in the energy and government sectors in Vietnam, and organizations with third-party relationships to EVN or its subsidiaries, should monitor for confirmation of this incident and treat any exposed customer data as a potential phishing/social-engineering enablement risk.

Source reporting: https://www.ransomware.live/id/VmlldG5hbSBFbGVjdHJpY2l0eShFVk5IQU5PSSlAZW1wZXJhZG9y