Ransomware victim disclosure
← All victimsESENTIA Energy Systems
Claimed by payoutsking · listed 21 days ago
Status timeline
- Listed
Apr 30, 2026
- Data leaked
At a glance
- Group
- payoutsking
- Status
- Data leaked
- Country
- MX
- Sector
- Energy
- Listed on leak site
- Apr 30, 2026
About the victim
AI dossier — public-source company profileESENTIA Energy Systems is a Mexican energy infrastructure company that develops, owns, and operates the largest private interconnected natural gas system in Mexico, known as the Sistema Wahalajara. It transports natural gas from the Waha Basin in Texas to major industrial centers across Mexico via more than 2,000 km of pipelines. Through its ESENTIA GAS division, with offices in Houston and Mexico City, it also provides integrated gas commercialization, supply, balancing, and price-risk management solutions.
- Industry
- Natural Gas Transportation & Distribution Infrastructure
- Address
- Periférico Sur 3433, San Jerónimo Lídice, CP 10200, Ciudad de México, México
Attack summary
Severity: high — ESENTIA operates critical national energy infrastructure (the largest private gas pipeline network in Mexico, supplying a significant share of daily national gas demand). A confirmed data publication against a critical infrastructure operator in the energy sector warrants a high severity rating even without granular data inventory details; potential exposure of operational, financial, and client data for a systemically important pipeline operator poses significant national and commercial risk.The ransomware group 'payoutsking' claims to have attacked ESENTIA Energy Systems and the disclosure status is listed as data_published, indicating data has been released; the leak post provides no specific detail on encryption or exfiltration methods, nor on the volume or nature of data involved.
Data the group says was taken
AI dossier — extracted from the leak post- Investor financial reports
- Quarterly and annual financial statements
- Shareholder assembly records
- Client service requests
- Press communications
- Corporate governance documents
- Operational asset data
Original description
AI-summarised, not from the leak postN/A
The leak post
captured from the group's sitePayoutsKing PayoutsKing Blog News About Partnership Welcome PK MAIN TOX: 535F403A2EA2DC71A392E18D7DB77FEF70845C0B7E5B9114CD30D301870304379C3547E324E2 Company Create Website Country Revenue Employees Actions Data Views Status H****l 2026-04-21 t****.com USA $786M ** Exfiltrated 860GB 0 Declared 1d 02:08 F****p 2026-04-14 fl****.com USA $2.7B ** Exfiltrated & Encrypted 1.1TB 0 Declared 1d 02:08 H****o 2026-04-01 has****.com USA $TBD ** Exfiltrated & Encrypted 4.8TB 0 Declared 1d 02:08 A****y 2026-03-31 ape****.com USA $309M ** Exfiltrated & Encrypted 3TB 0 Declared 2d 00:04 NTN Bearing Corporation of America 2026-04-24 ntnamericas.com USA $1.5B 4700 Exfiltrated 596GB 420 Proof 6d 02:09 About company: NTN Bearing is a producer of ball and roller bearings, with plants around the globe and a strong, domestic manufacturing network. Data description: Confidential, Employees' PII (Personally Identifiable Information), Correspondence, Financial, Engineering, Contracts, Agreements, NDA, FULL INFO SunSource 2026-04-20 sun-source.com USA $2B 3500 Exfiltrated 700GB 3401 Disclosed About company: SunSource is a distribution company, providing products, services, and information in…
Sources
Source
Indexed 21 days agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
