Skip to content
Leak-site post naming Vietnam Electricity(EVNHANOI), captured by ThreatCluster

Vietnam Electricity(EVNHANOI)

emperador

Ransomware leak-site victim intelligence

Data size
300.0 GB
Files
8
Views
12,746
Posted
Aug 22, 2026
Country
Vietnam
Industry
Electric utility

Summary

Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot

Emperador claims to have stolen more than 300GB of data from Vietnam Electricity (EVN), specifically its Hanoi unit EVNHANOI, across eight files in CSV and XLSX formats. The data categories claimed include customer details, subscriptions, and account records. The leak post is published and identifies the victim as Vietnam Electricity (EVN), legally Tập đoàn Điện lực Việt Nam, with EVNHANOI (evnhanoi.vn) as its Hanoi subsidiary.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

What was taken

For Sale Vietnam Electricity(EVNHANOI) $50,000 Vietnam Electricity (EVN), legally known as Tập đoàn Điện lực Việt Nam, is the largest power company and the sole national electric utility in Vietnam. Fully owned and controlled by the Vietnamese government since its inception in 1994, EVN operates as a vertically integrated monopoly responsible for the nationwide generation, transmission, and distribution of electricity, as well as international power exchanges. The group oversees all major power plants and regional distribution subsidiaries, including EVNHANOI. Serving as a crucial pillar for Vietnam's macroeconomic stability and industrial expansion, EVN is currently undertaking extensive grid digitalization and spearheading the national transition from coal dependency toward clean and renewable energy integration. The data content exceeds 300GB, comprising 13.36 million rows of customer details, 6.99 million subscriptions, 2.26 million account records, and other miscellaneous data.The price is open to negotiation. Session:054e5b6edf03e8ba012626b5dcd83a7dd47a046760bcd9b9b32d02a039d24d9608 Tox:852E34CBEBA2D40FD21BAC9F9E588B5194DBA9F31CACF9ECE316403120BE18765D22A8A453C4 samples1:https://pixeldrain.com/u/Kn7zctxy samples2:https://pixeldrain.com/u/avBUwyrE samples3:https://pixeldrain.com/u/89Lk2u1d

Data categories
customer detailssubscriptionsaccount recordsother miscellaneous data
File types seen
csv × 1xlsx × 7
Sample files (8)
cmis3_thuht_tables.xlsx
auth_users_sample500.xlsx
cmis3_baocaokd_congno.xlsx
cmis3_hopdong_cauhinh.xlsx
cmis3_hopdong_kehoach.xlsx
cmis3_thuht_tables.xlsx
cmis3_ungdung_trungap.xlsx
1.csv

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

Tox
852E34CBEBA2D40FD21BAC9F9E588B5194DBA9F31CACF9ECE316403120BE18765D22A8A453C4
Session
054e5b6edf03e8ba012626b5dcd83a7dd47a046760bcd9b9b32d02a039d24d9608
session
054e5b6edf03e8ba012626b5dcd83a7dd47a046760bcd9b9b32d02a039d24d9608
samples1
https://pixeldrain.com/u/Kn7zctxy
samples2
https://pixeldrain.com/u/avBUwyrE
samples3
https://pixeldrain.com/u/89Lk2u1d
sample_links
["https://pixeldrain.com/u/Kn7zctxy", "https://pixeldrain.com/u/avBUwyrE", "https://pixeldrain.com/u/89Lk2u1d"]
price negotiation
The price is open to negotiation.

Leak-site images (1)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture

Negotiation

Tox 852E34CBEBA2D40FD21BAC9F9E588B5194DBA9F31CACF9ECE316403120BE18765D22A8A453C4