Skip to content
Leak-site post naming Hanwha Renewables, captured by ThreatCluster
Back to victims

Hanwha Renewables

emperador

Ransomware leak-site victim intelligence

Data size
11.7 GB
Views
2,816
Posted
Aug 28, 2026
Country
KR
Industry
Energy & Utilities

Summary

Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot, ransom note

The group emperador claims to have published about 11.7 GB of data from Hanwha Renewables, tied to four PV projects seeking investment or financing. The leak page describes the data as including contractual documents, financial models, interconnection agreements, engineering designs, PII, and other sensitive financial information. The projects named are Bonanza Peak (3 GB), Boulder Solar III (0.7 GB), Obreron Portfolio (4.8 GB), and Project Sprout (3.7 GB); the victim is listed as Hanwha Renewables (domain hanwharenewables.com).

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

What was taken

The data contains really sensitive information from 4 PV projects looking for investment/financing of Hanwha. We extracted around 12GB of highly sensitive information relating to the following projects: - Bonanza Peak (3GB) - Boulder Solar III (0.7GB) - Obreron Portfolio (4.8GB) - Project Sprout (3.7GB) In the data we found highly sensitive information including: - PPAs - Financial models - Interconnection agreements - Engineering designs of the assets - Personal identifiable information - Sensitive reports, budgets, financial information Reach out to prevent the leak. Cost of litigation from counterparties for breach of confidentiality is way higher. Commercially, good luck negotiating after your practices and contracts are leak. Good luck looking for financing/investment for these assets with the data leaked.

Data categories
PPAsFinancial modelsInterconnection agreementsEngineering designs of the assetsPersonal identifiable informationSensitive reportsbudgetsfinancial information
File types seen
zip × 1
Sample files (1)
Hanwhadata.zip

Ransom note

Published by the group on their leak site, reproduced verbatim.

The data contains really sensitive information from 4 PV projects looking for investment/financing of Hanwha.
We extracted around 12GB of highly sensitive information relating to the following projects:
- Bonanza Peak (3GB)
- Boulder Solar III (0.7GB)
- Obreron Portfolio (4.8GB)
- Project Sprout (3.7GB)
In the data we found highly sensitive information including:
- PPAs
- Financial models
- Interconnection agreements
- Engineering designs of the assets
- Personal identifiable information
- Sensitive reports, budgets, financial information
Reach out to prevent the leak.
Cost of litigation from counterparties for breach of confidentiality is way higher. Commercially, good luck negotiating after your practices and contracts are leak. Good luck looking for financing/investment for these assets with the data leaked.

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

To Publish
Hanwhadata.zip (11.7 GB)

Leak-site images (1)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture