The Gentlemen ransomware group has listed EPMMOP, the Metropolitan Public Company of Mobility and Public Works of Quito, Ecuador, on its leak site. The municipal agency manages urban transport infrastructure and public works for a capital district of 2.7 million people.
The listing appeared on Oct 26, 2026 (UTC). No details on the volume or type of data allegedly taken have been shared so far.
The claim has not been independently verified, and EPMMOP has not publicly confirmed a cyber incident. The City of Quito previously suffered a BlackCat ransomware attack in Apr 2022.
Municipal public-works agencies hold contractor, procurement, payroll and citizen records. If the claim holds, suppliers and residents should expect invoice fraud and government-themed phishing. Unverified threat-actor claim, NOT confirmation of a breach.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
