EPMMOP · Breach

The Gentlemen ransomware claims attack on Quito public works agency

Oct 26, 2026 · 1 min read

The Gentlemen ransomware group listed EPMMOP, Quito's mobility and public works company, on its leak site on Oct 26, 2026. The listing shares no details on data volume or type, has not been independently verified, and EPMMOP has not confirmed an incident. Monitor the leak site and official communications until confirmation.

By HIFY Radar newsroom Updated 10/26/2026 01:53 PM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

The Gentlemen ransomware group posted on its leak site, on Oct 26, 2026, a claim of attacking EPMMOP, the agency managing urban transport and public works for Quito, Ecuador. EPMMOP has not confirmed the incident and the claim has not been independently verified. No details on data volume or type have been shared.

Why it matters

If confirmed, the incident could expose contractor, procurement, payroll and citizen records, according to the source's analyst note. Suppliers and residents could face invoice fraud and government-themed phishing. The agency serves a capital district of about 2.7 million people.

What to do

Await an official statement from EPMMOP and monitor the group's leak site for updates. Suppliers to the agency should tighten verification of changes to invoice payment details. Treat the claim as unconfirmed until validated.

For the technical team

Affected: EPMMOP (empresa metropolitana de mobilidade e obras públicas de Quito, Equador) · EPMMOP (Metropolitan Public Company of Mobility and Public Works of Quito, Ecuador), the municipal agency managing urban transport infrastructure and public works.
Exploitation: Claim of an attack by The Gentlemen group, posted on its leak site on Oct 26, 2026 (UTC) and reported by DailyDarkWeb. No details on data volume or type. EPMMOP has not publicly confirmed a cyber incident.
Fix: No software to update
More details: Unverified threat-actor claim, not confirmation of a breach. The City of Quito previously suffered a BlackCat ransomware attack in Apr 2022, per the source. The district served has about 2.7 million people.