Electricidad Panamericana Listed by direwolf Ransomware Group

On November 21, 2025, the ransomware group direwolf added Electricidad Panamericana to its leak site, claiming that internal files had been exfiltrated from the Latin American electricity provider.

What's Publicly Reported from Reporting

Public reporting indicates the company was listed on the direwolf leak site on November 21, 2025. Available details state that attackers exfiltrated internal files during a ransomware incident. The exact number of people whose information appears in the stolen data remains unknown. No sample files have been publicly released at the time of writing, and the precise volume or sensitivity of the documents has not been independently verified.

The listing follows the group’s standard pattern of publishing victim data when ransom demands are not met. Electricidad Panamericana has not issued a public statement confirming the breach or detailing what customer or employee records may have been taken.

Why This Matters for You and Your Family

When a utility company loses control of internal files, the information inside often includes names, addresses, phone numbers, national identification numbers, billing records, and sometimes bank details of residential customers. If your household receives electricity from Electricidad Panamericana or any affiliated provider, your family’s personal data may now sit on a ransomware leak site.

Stolen utility records are valuable because they link real-world addresses and account numbers to email addresses and phone numbers. Once exposed, these details can be used to impersonate you with banks, government agencies, or other service providers. Children’s names and dates of birth sometimes appear in family billing records, giving attackers the starting point for longer-term identity theft that can follow your family for years.

The Doxxing and Identity-Chain Implications

Utility breaches rarely stop at one company. Attackers combine the freshly leaked data with information from previous breaches to build detailed profiles. A phone number taken from your electric bill can be matched to a gaming account, a social-media handle, or a child’s school registration. This creates an identity chain that makes doxxing and targeted harassment far easier.

Credential leaks like this one frequently cascade into account takeovers. Once attackers control your email or phone number, they can reset passwords on every service that uses those credentials. Gaming accounts belonging to you or your children are especially vulnerable because they often share the same email address listed on household utility bills.

Direwolf Group’s Publicly Known Track Record

Public reporting attributes the attack to the direwolf ransomware group. The group emerged in 2024 and has targeted organizations across multiple sectors, including manufacturing, healthcare, and critical infrastructure. Notable prior victims listed on its leak sites include mid-sized industrial firms and regional service providers.

The group’s typical playbook begins with initial access through phishing or exploited remote desktop credentials, followed by rapid exfiltration of internal documents. It then demands payment and, if unpaid, publishes stolen files on its dark-web leak site. Extortion tactics focus on both financial ransom and the threat of full data release rather than widespread distribution on multiple forums.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, addresses, and online handles that may have been exposed in this incident.
• Rotate any password you used at Electricidad Panamericana or any affiliated utility portal, then enable two-factor authentication through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught and addressed within hours rather than months.
• Cover the household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests for any personal records that surface on data-broker sites or underground marketplaces.

The Electricidad Panamericana listing is a reminder that everyday services can become gateways to identity theft. Taking concrete steps now limits how far attackers can travel down the chain of information that starts with a single utility breach. DoxxScan by GalaxyWarden delivers continuous monitoring across more than 13.1 billion+ breach records and over 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with coverage that includes your entire household and your children’s gaming accounts.