Skip to content
Ecuador's EPMMOP Listed as Ransomware Victim by The Gentlemen Group

Ecuador's EPMMOP Listed as Ransomware Victim by The Gentlemen Group

First seen 31 Oct 2026, 08:42 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 31, 2026 at 09:42 UTC
  • •EPMMOP, a public works agency in Quito, Ecuador, has been listed as a ransomware victim.
  • •The Gentlemen ransomware group has not disclosed details about the data allegedly taken.
  • •EPMMOP has not confirmed any cyber incident, and the claim remains unverified.

The Gentlemen ransomware group has listed EPMMOP, the Metropolitan Public Company of Mobility and Public Works of Quito, Ecuador, on its leak site as of October 26, 2026. EPMMOP manages urban transport infrastructure for a capital district of 2.7 million people. The listing does not provide details on the volume or type of data allegedly taken, and EPMMOP has not confirmed the incident. The agency previously experienced a BlackCat ransomware attack in April 2022. If the claim is valid, it could lead to invoice fraud and government-themed phishing targeting suppliers and residents. The situation remains unverified, with no independent confirmation of the breach.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-26
EPMMOP listed on ransomware leak site
The Gentlemen ransomware group included EPMMOP on its site, claiming it as a new victim without confirming data details.
X
Recent
EPMMOP has not confirmed incident
The agency has not publicly acknowledged any cyber incident related to the ransomware claim.
Ransomware.Live

More articles in this cluster (2)

Following this threat?

Track BlackCat and Epmmop in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (10)

1 / 3

Common questions

Has EPMMOP confirmed the ransomware incident?
No, EPMMOP has not publicly confirmed any cyber incident related to the ransomware claim.
What type of data might be at risk?
If the claim is valid, municipal agencies typically hold contractor, procurement, payroll, and citizen records.
What should residents and suppliers do?
They should remain vigilant for potential invoice fraud and government-themed phishing attempts.