Nepal Electricity Authority · Breach

[Single source] Claim: Climax ransomware lists Nepal Electricity Authority on leak site

Nov 10, 2026 · 1 min read

The Climax ransomware group added the Nepal Electricity Authority, the state utility running most of the country's power generation, transmission and distribution, to its leak site, marking the case as published. No data volume, samples or affected systems have been verified, and the NEA has not confirmed an incident. Wait for an official statement before treating data as leaked.

By HIFY Radar newsroom Updated 11/10/2026 10:20 AM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In 30 seconds

Alleged

The Climax ransomware group has added the Nepal Electricity Authority, the state company that generates and distributes most of Nepal's electricity, to its dark web leak site, according to a November 10 post by threat intelligence account DailyDarkWeb. The listing is marked as published, but no files, samples or data volume have been checked by anyone outside the group, and the utility has not confirmed any incident.

Inferred

Treat this as an unverified threat-actor claim rather than a confirmed breach. A listing on a ransomware blog is the criminals' own announcement, which is pressure, not proof.

What happened

Alleged

On its leak site, the page ransomware crews use to pile pressure on victims by publishing stolen data, Climax created an entry for the Nepal Electricity Authority at nea.org.np and marked it Published, the DailyDarkWeb post reports.

Observed

That is the entire event so far. No data volume has been measured, no sample files have been verified, no affected systems have been named, and the NEA has made no public statement confirming an incident.

Why it matters

Inferred

The Nepal Electricity Authority runs most of the country's power generation, transmission and distribution, so any real intrusion would be a critical infrastructure concern, not a routine corporate data incident. An attack on a national grid operator touches the systems that keep lights on.

Inferred

That concern is hypothetical for now. It only becomes concrete if the NEA confirms a breach or verifiable data surfaces, and neither has happened.

What to do

Inferred

Wait for an official NEA statement before treating any data as actually leaked. The reporting source itself says to treat this as an unverified threat-actor claim, not confirmation of a breach.

Inferred

If you track Nepali infrastructure, watch the utility's official channels and the leak site itself for real file releases. The strongest next signals would be an NEA acknowledgment, verifiable sample files, or independent confirmation of the listing. None of that exists yet.

Confirmed and still uncertain

Alleged

Known: a leak site entry naming the NEA exists and carries a Published mark, per DailyDarkWeb's report. Separately, a hacktivist group claimed admin access to the NEA mobile app in November 2025, an earlier and unrelated claim.

Inferred

Unknown: how much data, if any, was taken; which systems, if any, were touched; whether Climax actually breached anything; and whether the NEA is even investigating. The utility's silence leaves every one of these questions open.

What people are saying

Observed

DailyDarkWeb, the account that surfaced the claim, is explicit about its own limits: it labels the case an unverified threat-actor claim and tells readers it is not confirmation of a breach.

Alleged

The Climax group's only statement is the listing itself, a name and domain on a leak page with no proof package attached. The NEA has said nothing publicly in response.

Evolution

Contested

This is not the first time attackers have named the NEA. In November 2025 a hacktivist group claimed administrator access to the utility's mobile app, and the NEA at the time attributed the disruption to routine maintenance. That dispute was never publicly resolved.

Inferred

The earlier episode is a useful template: claims against the NEA have surfaced before, and the utility previously answered with a mundane explanation. Whether this case follows the same path or turns into a confirmed breach is entirely unknown.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Inferred

A ransomware leak site is the criminals' storefront: groups list organizations they claim to have breached, then release files in stages to pressure the target into paying. A Published mark signals the group says it has moved to the release stage.

Alleged

In this case the entry points at nea.org.np, the domain of the state utility, and carries the Published label, according to the screenshot shared by DailyDarkWeb. What sits behind that label, actual stolen files or an empty threat, has not been verified by anyone outside the group.

Sources and evidence

Observed

This story rests on a single source: a November 10 post by DailyDarkWeb on X that reports the Climax listing, embeds a screenshot of the leak site entry, and flags the critical infrastructure angle.

Observed

That source carries its own warnings, stating that no data volume, samples or affected systems are verified and that the NEA has not confirmed an incident. The claim is thin by design, one leak site entry and one researcher's read, and every breach assertion in this story inherits that fragility.