Climax ransomware group claims Nepal Electricity Authority attack

What happened

According to RansomLook, a ransomware leak-site tracker, the climax ransomware group lists Nepal Electricity Authority on its leak site. The headline is dated 2026-11-10 RansomLook: Nepal Electricity Authority: claimed by the climax ransomware group on its leak site.

Only the headline could be retrieved. The full article could not be reviewed, so this advisory goes no further than what the headline says.

Not confirmed:

• Whether Nepal Electricity Authority has acknowledged any incident.
• Whether any systems were encrypted or any data was taken.
• The volume or type of data involved.
• How an attacker might have gained access.
• Any independent verification of the group’s claim.

A listing on a leak site is the group’s own claim, not proof of a breach.

Am I affected?

Not confirmed. The source does not say which systems, data or customers are involved. No other outlet carrying this story was found. If you are an employee, supplier or partner of Nepal Electricity Authority, check for direct communication from the organisation. No technical indicators, CVEs or affected software are named in the source.

What to do now

1. Wait for an official statement from Nepal Electricity Authority before treating the claim as confirmed.
2. If you deal with the organisation, use contact details you already hold, not links in unsolicited messages, to ask whether you are affected.
3. Re-check the RansomLook entry for updates: RansomLook.

Sources

• RansomLook: Nepal Electricity Authority: claimed by the climax ransomware group on its leak site