EPM BlackCat ransomware attack

On 12 December 2022, Empresas Públicas de Medellín (EPM) — Colombia's largest publicly owned multi-utility — was struck by a ransomware attack widely attributed to the BlackCat (ALPHV) operation. The intrusion encrypted internal systems and forced one of the country's most important critical-infrastructure operators into days of manual, paper-based working.

What happened

EPM provides electricity, water, natural gas, and sanitation to roughly 123 municipalities and is one of the largest companies in Colombia, with revenues exceeding the equivalent of tens of billions of dollars. On the morning of 12 December 2022, the company detected that internal systems had been encrypted and that online customer services had gone dark.

The following day, EPM told approximately 4,000 employees to work from home and pulled large parts of its IT infrastructure offline to contain the spread. The company publicly characterised the event as a cyberattack while emphasising that the physical supply of utilities — generation, water treatment, and distribution — was never interrupted, because operational technology was isolated from the affected corporate network.

Attribution

EPM never officially named the perpetrator. However, the Chilean security researcher Germán Fernández discovered a fresh sample of ExMatter, the bespoke data-exfiltration tool used by the BlackCat/ALPHV ransomware-as-a-service operation, uploaded to a malware-analysis service from Colombia in the same window. The ExMatter sample pointed to a poorly secured remote server, and researchers concluded BlackCat was behind the EPM intrusion and had stolen corporate data, consistent with the gang's double-extortion model.

Impact

• Around 4,000 staff were sent home and reverted to manual processes for billing, procurement, and customer service.
• Customer-facing portals, payment channels, and internal email were disrupted for several days.
• Utility supply to 123 municipalities continued, but back-office recovery stretched over weeks.
• EPM did not publicly confirm any ransom payment, and the precise volume of exfiltrated data was never disclosed.

Why it matters

The EPM attack was one of the most consequential strikes against Latin American critical infrastructure in 2022. It demonstrated both a strength and a warning: the segmentation between IT and operational technology prevented a billing-system compromise from cascading into a loss of power or water — yet a single ransomware event still paralysed the corporate functions of a utility serving millions. For Colombia, it foreshadowed a wave of high-profile incidents — including the Keralty health-network breach days earlier and the 2023 IFX Networks supply-chain attack — that exposed how exposed the country's institutions remained to ransomware extortion.