Emperador Ransomware Hits Vietnam Power Utility EVNHANOI: 300GB Data, 13.36M Customer Records Leaked; Another Alarm for Asian Critical Infrastructure

Ransomware group Emperador on 22 August 2026 publicly claimed an attack on Vietnam national power company EVNHANOI, alleging theft of more than 300GB including 13.36 million customer records, 6.99 million subscriptions, and 2.26 million account records. The incident exposes Asian critical-infrastructure fragility against ransomware crews. Incident response, credential rotation, and external monitoring are now table stakes.

Incident Overview

On 22 August 2026, ransomware group Emperador posted attack results against Vietnam national power company EVNHANOI (evn.com.vn) on its dark-web leak site. Per the disclosure, total data exceeds 300GB, structured as 13.36 million rows of customer detail, 6.99 million power subscription records, 2.26 million account records, and more, with pricing left open for negotiation. The group has not released a decryptor, but published sample data screenshots to prove access. Emperador left price as a negotiation item, showing this op is data extortion + public shakedown rather than classic smash-and-encrypt.

EVNHANOI is one of Vietnam's largest power companies, serving Hanoi and surrounding provinces, with base energy-supply duty. Mass leak of a utility's customer, subscription, and account databases hits billing accuracy, personal-data protection compliance (Vietnam Personal Data Protection Law), and potential national critical-infrastructure security assessment. Attack volume (300GB, tens of millions of records) already ranks among APAC's largest ransomware hauls this year.

Technical Details and Attack-Chain Inference

Emperador did not publish a specific intrusion path on the leak site. Combining recent ransomware tradecraft against critical infrastructure, reasonable entries include: internet-exposed VPN/RDP endpoints, initial payloads on unpatched high-severity vulns, phishing of IT ops accounts, then Active Directory lateral movement into mail stores, CRM, billing, and SCADA management networks. In ~300GB packed-exfil ops, operators typically AES-256 encrypt first then dual-track transfer to avoid DLP and traffic alerts.

Ops-side traits: Emperador has run continuously on the dark web since 2025. Known methods include initial-access resale, staged ransom negotiation (sample first, incremental public dumps if unpaid), partnering with initial-access brokers to distribute access, and lowest-cost attacks against traditional weak IT in power, healthcare, and education in developing countries. The EVNHANOI case likely belongs to this crew's rotation against large regional critical-infrastructure targets.

Impact Assessment

Customer and Compliance

• 13.36 million customer details may include name, address, partial national-ID fields, meter IDs, usage class (residential/commercial/industrial), and historical bill summaries
• 6.99 million power subscription records corroborate household and enterprise coverage
• 2.26 million account records may contain password hashes, login tokens, internal system accounts, and other sensitive credentials
• Even if the utility encrypted credential fields, matching plaintext backups, object-storage access logs, and third-party service credentials may have leaked with them

Operations and Infrastructure

• Public dump of ransomed customer data directly hits billing collection, brand trust, and regulator comms
• Credential leak expands follow-on APT and ransomware lateral surface against Vietnam's power ecosystem
• May force temporary OT/IT isolation policy, including tighter SCADA access audit during the external-leak window
• Stacked on 2024-2025 ransomware against Southeast Asian grids, airports, and hospitals, it hits regional reputation and cross-border cooperation

Remediation and Defense

Incident Response and Emergency

• Run attribution forensics; confirm entry and lateral path; retain disk images, logs, mail, and permission-change records
• Immediately enforce MFA and source restrictions on all EVNHANOI internet-exposed VPN, RDP, mail, and web consoles
• Force-reset all ops, customer-service, and billing accounts, including downstream contractor and helpdesk accounts
• Isolate mail archives, CRM, customer DBs, and file servers that may have been packed for exfil; confirm backup integrity and immutability before external disclosure
• Enable fraud-script and credential-reset coordinated comms on customer-facing billing sites, payment apps, and IVR

Mid- to Long-Term Hardening

• Implement network segmentation; fully isolate OT, billing office, and internet-facing business; restrict cross-segment credential reuse
• Stand up immutable backups (e.g. object storage + Object Lock, Air-gapped Tape) and weekly restore drills
• Deploy or expand SIEM and XDR; integrate EVN Group existing log infrastructure with threat-intel subscriptions
• Establish SBOM and third-party supply-chain management covering billing, CRM, customer-service software, and other business-surface deps
• Open threat-intel sharing with Vietnam national cybersecurity authorities, local CERT, and international ISACs (e.g. E-ISAC)
• Run phishing drills and credential-use audits for exec, ops, and finance high-sensitivity roles

Industry Level

• Inventory critical infrastructure for Vietnam and Southeast Asia power, water, gas, and transport sectors
• Push regional ransomware-payment compliance and reporting rules; stand up fast response with law enforcement and Interpol
• Evaluate and procure WAF, Anti-APT, and Honeypot solutions with Anti-Ransomware and IOC blocking
• Institutionalize OT-IT defense-in-depth drills and third-party audit

Emperador vs EVNHANOI is both the latest typical APAC critical-infrastructure ransomware case and a wake-up for global large energy-enterprise ISACs. Under falling attacker cost and rising payoff, defenders must operate incident response, immutable backup, credential governance, and external intel as daily baseline—not tools bolted on after an incident.

References

• DeXpose public incident report
• Emperador dark-web leak site original post
• Public reporting from Bleeping Computer, The Record, Security Affairs, and others