Nueva EPS denies unauthorized access

Nueva EPS said its checks so far have not found evidence of unauthorized access to its systems, and its investigation remains ongoing to determine the truth and origin of reports about a supposed data leak. The company responded to posts that circulated in specialized media and in cyberextortion reports.

What was said about Nueva EPS?

Several reports attributed to an unidentified actor the possession of data linked to Nueva EPS, but there was no official confirmation from the entity at the time. DataBreaches reported that an individual or group claimed to have compromised the EPS and demanded $15 million in Bitcoin to avoid disclosing the information, although it also said the claim had not been verified by the company when published.

El Colombiano, meanwhile, reported that an anonymous actor had posted a database attributed to Nueva EPS with 11,239,741 records spread across 34 files. According to that outlet, the material would have included identity, contact, health, and enrollment data, but the alleged leak still had not been confirmed by Nueva EPS.

What other versions circulated?

There were also reports with partial data and no official validation. MuchoHacker.lol said it analyzed 30 records shared as proof by the actor claiming to have Nueva EPS data, although it said it did not access the EPS systems or download additional information, and could not confirm either the authenticity of the database or the existence of extortion.

Dark Web Informer also reported a separate claim from an actor identified as "nuevaeps," who allegedly exposed 29,018 records tied to Nueva EPS users in Vaupés. The site marked both the authenticity and origin of those records, as well as the claim that roughly 11 million more existed, as unverified.

What is known about the other incidents in Colombia?

BlackFog reported a ransomware incident against Colombia's Ministry of Justice, with file encryption and partial impact on its technology infrastructure. According to that report, the impact reached public services tied to legal procedures, document management, and monitoring of illegal drugs.

In another case, Malware.news reproduced an extortion list it attributed to ThreeAM, which allegedly described a breach against Coosalud EPS in Colombia. The site said the group threatened to publish a full data dump unless a representative made contact, but the attribution was presented as uncertain by the source itself.

These reports emerged over a period of just a few days and point to different cases, with one common thread: in several of them, there is still not enough public validation to confirm the real scope of the alleged leaks or intrusions.