Two separate ransomware operations have each put Ecuador's National Police on their leak sites within three days of each other, and neither has shown a single stolen file. A newly surfaced crew called HYFLOCK posted the force's General Command in Quito on 12 October, according to the independent tracker ransomware.live's record of the listing. On 14 October The Gentlemen, one of the busiest extortion brands of the year, added the same agency under the name "Ecuadors National Police" (tracker record).
Both posts name the same domain, policia.gob.ec. The police have not confirmed an incident that we could find at the time of writing, and both claims remain exactly that: statements written by the gangs themselves.
Two posts, and no data in either
What the two listings contain is telling. HYFLOCK's post reads like a briefing note on its target: the headquarters address on Avenida Amazonas, the command structure under the Ministry of Interior, the Criminal Investigations Department and the INTERPOL National Central Bureau that sits inside it. The Gentlemen's post is a statistical profile, citing more than 58,000 officers and the force's 2025 operational record of arrests and drug seizures.
Neither describes what was supposedly taken. There is no file count, no data volume, no sample screenshot and no category of record. Everything quoted in both posts is the kind of material an agency publishes about itself. That does not mean nothing happened, since crews often add the stolen data later as a deadline approaches, but on the evidence posted so far there is nothing to assess beyond the claim.
A brand-new crew and a very busy one
The two names sit at opposite ends of the leak-site economy. HYFLOCK is days old. Its first listing in our incident tracking is dated 13 October, and it has posted eight victims since, spread across Canada, Brazil, Saudi Arabia, Nigeria, India and Ecuador. Two of HYFLOCK's eight claims are in South America, and a national police force is an unusually prominent name for a crew this new. Its profile is on our HYFLOCK actor page.
The Gentlemen is the opposite case. Our tracking holds 130 of its claims in the last 30 days alone, 72 of its listings overall are in South America, and it featured in our look at Brazil's record month on the leak sites. A double listing of one victim by two crews can mean several things: an initial access broker selling the same foothold twice, an affiliate working for more than one programme, recycled data, or simply two opportunistic posts. The listings alone do not tell us which.
Ecuador's week in context
Ecuador is a small presence in the leak-site data. Our tracking records three claims against Ecuadorian organisations in the past seven days, against an average of one every four weeks or so before that. The third was a Qilin listing for the Ecuadorian company ConAuto on 12 October. Three claims is not a surge in itself; the target is what stands out. A national police force holds investigative files, informant details and personal data on officers and citizens, and in a country fighting organised crime that material has value far beyond a ransom.
Assume the claim is live until the police say otherwise
Officers and staff of the National Police should treat unexpected messages that reference internal matters or personal details with suspicion, and the force's partners should watch for phishing that impersonates it. Organisations in Ecuador that confirm a personal data breach report to the Superintendence for the Protection of Personal Data, and EcuCERT coordinates national incident response. Country context sits on our Ecuador page.
Two gangs claiming the same police force in one week proves less than it seems. If either one publishes data, it will prove a great deal more.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.