Incransom Claims Data Theft From Sangre de Cristo Electric Association
Summary
Incransom claims it stole customer, financial, utility, and OT security data from Sangre de Cristo Electric Association. The monitoring post says the claims are unverified and negotiations reportedly ended.
Key points
- The post identifies Sangre de Cristo Electric Association as the alleged victim and Incransom as the actor.
- The group allegedly stole customer PII, financial and payment data, and utility account information.
- The claimed data includes infrastructure and OT details, including substations, transformers, outage information, and SCADA/EMS environments.
- The post alleges stolen control-system credentials, API keys, and OT security configurations.
- The group reportedly said negotiations ended and threatened further disruptive actions.
- The post attributes the claims to Incransom’s leak site at hxxp://incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion and states it could not verify them.
Article Details
- Victim
- Sangre de Cristo Electric Association
- Claim Date
- 2026-10-01
- Encryption Status
- Unknown; the source does not report whether data was encrypted.
- Exfiltration Status
- Unverified group claim; incransom claims sensitive information was compromised and taken.
- Exfiltrated Data
- The group claims the data includes customer PII, financial and payment data, utility account details, energy infrastructure and operational technology information, control-system credentials, API keys, and OT security configurations.
- Leak Status
- The claim was published on incransom's disclosure site; the source does not confirm that the data was publicly leaked or authenticate it.