Quito's municipal transport and public works company is the latest Ecuadorian organization to appear on a ransomware leak site. The Gentlemen listed EPMMOP, the Metropolitan Public Company of Mobility and Public Works of Quito, on October 31, according to IntelFusions incident tracking. The same crew named the Guayaquil pharmacy group Farmacias 911 on the same day.
These are unverified claims posted by the gangs themselves. Neither organization has confirmed a breach in anything we have seen, and a leak-site listing is not proof that data was taken.
Eight Ecuadorian names in three weeks
On its own, one more listing would not be news. The pattern around it is. Between October 12 and October 31, six different extortion crews named eight Ecuadorian organizations. Across the more than three months before that, from late June to early October, our data holds seven Ecuadorian listings in total. Ecuador has gone from roughly one claim every two weeks to several a week.
The list is unusually heavy on public institutions. Qilin opened the run on October 12 with ConAuto, which it tagged as a transportation company. Ecuador's National Police was then claimed twice in four days, by HYFLOCK on October 13 and by The Gentlemen on October 16. On October 24 N0n posted Guayaquil health insurance administrator Asisken, claiming identity and claims records for 139,006 named clients, a listing we covered in our South America roundup.
The last week added four more. Alongside EPMMOP and Farmacias 911, Emperador named the road freight company Transportes Jimenez y Reyes on October 26, and SafePay posted the domain of a Quito-based firm that, according to the listing, advises businesses, investors and multinationals operating in Ecuador.
What the gang says it reached at EPMMOP
Very little, in public. The Gentlemen's write-up describes the agency's role, citing the TelefériQo cable car and a capital district of 2.7 million people, but it publishes no sample of stolen data and no claim about volume. That is the crew's usual format: in our data its listings lean on marketing copy about the victim rather than proof of access. There is no sign in what we have seen of any disruption to Quito's transit services.
No single crew is driving the rise. Six groups account for the eight listings, and only The Gentlemen appears more than once. That matches what we see elsewhere in the region, where Latin American victims surface across many crews rather than through one operator's campaign.
Report to EcuCERT, and check supplier access now
Organizations named here, and the contractors and suppliers that connect to them, should not wait for a public disclosure. Check remote access and shared accounts that cross into those environments, rotate credentials that do, and watch for phishing that reuses names, contracts or invoice details. Ecuadorian organizations can report incidents to EcuCERT, the national CERT listed on our Ecuador profile, which also notes that the Superintendence for the Protection of Personal Data is now fully active. Clients of Farmacias 911 and Asisken should be alert to messages that quote their own details back to them.
Eight listings do not prove eight breaches. What they do show is that Ecuador, a country that rarely appeared on these sites a few months ago, has moved onto several crews' target lists at once, and that its public sector is taking a large share of the attention.
This briefing is provided by IntelFusions for informational and defensive purposes only. It summarizes extortion claims published by ransomware leak sites. Those claims are made by the attackers, are unverified, and may be false, exaggerated, or recycled from earlier breaches. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.