Ikeja Electric: ransomware and database incident claimed on DarkForums

Overview

In late April 2026, a DarkForums user named ByteToBreach, who holds GOD rank on the forum, posted an account of a ransomware operation against Ikeja Electric, a major electricity distribution company in Lagos, Nigeria. The post includes a series of screenshots documenting lateral movement through the company's network, encryption of more than 50 hosts, and claims of exfiltration. The incident was also discussed on Reddit and covered by cybersecurity blogs.

What was published

The poster describes:

• Deployment of ransomware on more than 50 hosts after compromising ESXi and vCenter infrastructure
• Shutdown of many subdomains and internal services
• Screenshots of the network map, a service account, a backup admin panel, vCenter pivoting, and backup systems including Veritas and Veeam
• Claims of an additional incident involving customer databases

Risks for affected individuals

Ikeja Electric customers may be affected if customer or billing records were among the exfiltrated data. Disruption to internal systems can delay billing, complaint handling and service restoration. Power distribution data and customer contact details could be used for fraud.

What remains unknown

The number of customer records exposed is not stated, and no customer database has been publicly released. Ikeja Electric has not published a breach notice about this incident. The ransom demand, if any, is not disclosed.

What affected people should do

Ikeja Electric customers should monitor their accounts for unauthorized changes, be alert to phishing messages posing as the utility, and contact the company through official channels if they receive suspicious payment requests.