The Emperador ransomware group has listed EVNHANOI, the Hanoi distribution subsidiary of state-owned Vietnam Electricity (EVN), on its leak site, claiming theft of more than 300GB of customer and account data. The listing was published on 2026-08-22 at 15:32 UTC and picked up by monitoring feeds roughly 48 minutes later, at 16:20 UTC. One important caveat up front: every source available on this incident is aggregator or secondary tier. There is no victim statement, no Vietnamese national CERT advisory, and no regulator filing confirming the intrusion. What follows is an attacker claim reported by multiple trackers, not a verified breach.
What Happened
Emperador posted a victim page for "Vietnam Electricity (EVNHANOI)" advertising over 300GB of exfiltrated data and stating that the ransom price is open for negotiation. Hendry Adrian's ransomware monitoring feed logged the post with a discovery timestamp of 2026-08-22T16:20:45 UTC and a publication timestamp of 2026-08-22T15:32:00 UTC, sector tagged Energy and Utilities, country Vietnam. Undercode News independently covered the listing the same day, attributing its own reporting to a third-party feed (Cybersecurity News Everyday) and repeating the roughly 300GB figure and the negotiable-ransom detail. Undercode explicitly noted that the report it worked from "did not provide independent technical evidence." Undercode ran a second piece hours later bundling the EVNHANOI claim into an unrelated USPS mail-ballot story; that item adds no new detail about the utility and should be treated as syndication noise rather than corroboration.
There is a real entity ambiguity in the reporting worth flagging. Hendry Adrian's writeup describes the victim as "Vietnam's state-owned national electric utility" responsible for nationwide generation, transmission and distribution, then separately notes that EVN "oversees major power plants and regional distribution subsidiaries, including EVNHANOI." Those are two different organisations. EVNHANOI is the capital-region distribution operator, a subsidiary. Nothing in the available sourcing establishes that Emperador reached EVN group systems, and defenders should not assume national-grid scope from a subsidiary listing. Accounts differ on how the victim is characterised, and the narrower reading is the safer one.
No source reports encryption of operational systems, no source reports any interruption to electricity supply in Hanoi or elsewhere, and no source reports OT or ICS involvement. On the evidence available this is a data-theft extortion claim against IT-side systems.
What Was Taken
The volume figure is consistent across the two substantive sources: over 300GB per Hendry Adrian, approximately 300GB per Undercode News. There is no competing figure to reconcile.
Only Hendry Adrian breaks the claim into record counts, and those counts come from the leak-site listing itself rather than from any independent examination:
- 13.36 million customer detail rows
- 6.99 million subscriptions
- 2.26 million account records
- unspecified additional data
Because that breakdown appears in a single aggregator source restating attacker claims, treat it as an allegation. Emperador has an obvious incentive to inflate. That said, the order of magnitude is not implausible for a metropolitan distribution utility serving greater Hanoi, where customer counts in the millions are ordinary.
The sensitivity profile is what makes this consequential if true. Utility customer databases correlate a verified name to a physical service address, meter identity, billing history and often a national ID number and payment instrument. That is a high-fidelity population dataset, useful for fraud, for targeted social engineering against utility customers, and for physical-location intelligence on individuals of interest. Undercode framed the same point in terms of customer privacy, financial information and operational intelligence all becoming part of the exposure surface.
Why It Matters
Emperador is an emerging operation, and its recent victim set shows a clear appetite for public-sector and high-trust targets rather than opportunistic mid-market enterprises.
On 10 August 2026 the group published the City Government of Baguio in the Philippines. Breach House catalogues that leak at 2.9GB spanning official contracts, legal permits, identification documents, financial statements, construction blueprints, project proposals and procurement records. Breachsense tracks the same victim with a discovery date of 12 August 2026 and lists the leak size as unknown, so the two trackers differ on both timeline granularity and volume. Breach House's own "Window Zero" metric records the Baguio exposure as 10 days open with no disclosure or notification from the victim as of indexing.
On 20 August 2026, two days before the EVNHANOI listing, Emperador published NetExam, a Dallas-based SaaS learning management platform whose client list includes AMD, AT&T, Oracle, Trellix and Sabre. Breach House and HookPhish both put that leak at 18.1MB, a trivial volume that reads more like proof-of-access than a full exfiltration. Today In Cyber's analyst note on the NetExam listing flagged Emperador as an emerging actor whose claims "should be treated with caution until independently verified," and read the LMS targeting as supply-chain-adjacent.
The pattern across three weeks is a city government, a SaaS platform sitting upstream of several major enterprises, and now a capital-city electricity distributor. Claimed volumes swing wildly, from 18.1MB to 300GB, which is characteristic of a young operation that publishes whatever it obtains rather than one running a disciplined exfiltration playbook. The common thread is not a sector; it is institutions whose customer or citizen trust is the pressure point. Notably, none of the three victims tracked here had issued a public disclosure at the time of indexing, which means the extortion clock has been running publicly while affected populations were unaware.
The Attack Technique
Initial access is unknown. No source in this set identifies an intrusion vector, a dwell time, an exploited CVE, a ransomware variant or family lineage, or any indicators of compromise for the EVNHANOI incident. Anyone publishing a specific vector for this case is going beyond the record.
What can be said about tradecraft is structural. Emperador is operating a data-theft-first extortion model, with the ransom explicitly left open to negotiation rather than posted as a fixed sum. Undercode read that as the operators probing for the victim's pain threshold instead of anchoring a public price, which is consistent with an actor still calibrating against unfamiliar target classes. Encryption is not reported in any of the three victim cases here; the leverage is publication.
The Baguio case offers one adjacent signal, though it is correlation and not attribution. Breachsense indexed 8,369 credentials for baguio.gov.ph and 165 city-domain accounts appearing in external breaches, including 3,681 infostealer logins across 2,024 infected devices, with activity as recent as 8 August 2026, days before the listing. Breach House separately counted 7,211 baguio.gov.ph findings in infostealer logs. For NetExam, Breach House logged 354 infostealer hits and 298-plus appearances in traditional breaches. No source connects those credential pools to the intrusions themselves, but heavy pre-existing infostealer exposure at a victim domain immediately preceding a listing is the pattern defenders should be watching for.
What Organizations Should Do
- Hunt your own domain in infostealer corpora, not just breach dumps. The credential exposure visible at Emperador's prior victims was measured in thousands of logins from thousands of infected devices. Enumerate exposed credentials for corporate and subsidiary domains, force-reset anything that appears, and treat a spike as an intrusion precursor rather than a hygiene metric.
- Enforce phishing-resistant MFA on every external entry point, including subsidiaries. Valid credentials are worthless against FIDO2 or hardware tokens. Push-notification and SMS second factors are not sufficient. Audit VPN, remote desktop, webmail and vendor portals for accounts that still bypass MFA.
- Assume the subsidiary is the way in and segment accordingly. A regional distribution unit typically has weaker controls than group IT while retaining trusted network paths into it. Verify that EVNHANOI-equivalent business units in your own estate cannot pivot laterally into core systems, and that IT and OT networks are separated by enforced boundaries rather than convention.
- Instrument for bulk egress. 300GB does not leave a network quietly. Alert on large outbound transfers to cloud storage and file-sharing services, on unusual volumes from database hosts, and on archive creation on servers that have no business producing archives.
- Lock down the customer database specifically. Utility subscriber tables are the crown jewel in this attack pattern. Restrict bulk-export capability to named accounts, log and alert on every mass read, encrypt at rest with keys held outside the application tier, and cap what any single compromised service account can pull.
- Have the disclosure decision made before you need it. Every Emperador victim reviewed here sat undisclosed while their data was publicly advertised. Pre-agree the notification thresholds, the regulator contacts and the customer-communication path now, so the choice is not being made under extortion pressure.
- Track the listing, but do not treat it as confirmed. Until EVNHANOI, EVN or a Vietnamese authority speaks, this remains an attacker claim carried by secondary trackers. Monitor for an official statement and for actual leak publication, which is the point at which claimed volumes become verifiable.
Sources: Ransom! Vietnam Electricity(EVNHANOI) (AUG-2026) | Vietnam’s Power Grid Under Pressure: EVNHANOI Hit by Emperador Rans... | USPS Mail-Ballot Rules Face Court Battles as EVNHANOI Suffers a Maj... | NetExam — EMPERADOR Ransomware Attack Breach House | Ransomware Group emperador Hits: NetExam | City Government of Baguio — EMPERADOR Ransomware Attack Breach House | City of Baguio Data Breach in 2026 Breachsense | 🏴☠️ Emperador has just published a new victim : NetExam Today In...