According to Semana, citing a statement from EPM, the company discovered on May 23, 2025, that its Factura Web payment page had been impersonated, diverting customer payments to third parties [1]. The company stated that it had contained the issue but preventively shut down its official website, mobile application, and certain other digital payment channels [1]. EPM advised users to temporarily make payments through authorized physical channels and explained that its official digital payment process requires account authentication [1].
This event has not been officially confirmed. Content is based on media or third-party reports.
Backfill: this event became public on May 25, 2025 and we added it on Nov 10, 2026. It is not a new event.
HighMonitoringBackfillMedia reported
Colombia's EPM Reports Impersonation of Factura Web Payment Portal Diverting Funds to Third Parties
1 min read
- Disclosed
- May 25, 2025
- Occurred
- May 23, 2025
- Published
- Nov 10, 2026
- Last updated
- Nov 7, 2026
- CVSS basis
- Our assessment
- Attack vector
- Impact
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Energy
What to do nowOur advice
EPM advised users to temporarily make payments through authorized physical channels and explained that its official digital payment process requires account authentication [1].
Timeline
- Incident publicly disclosed[1]
Technical details
Source-Supported Details
EPM advised users to temporarily make payments through authorized physical channels and explained that its official digital payment process requires account authentication [1].
Source excerpt: "Paralelamente, en septiembre del año pasado la distribuidora de energía eléctrica de la Costa Caribe, Air-e, sufrió un ciberataque de , lo que interrumpió servicios importantes para sus clientes y afectó sus sistemas internos." [1].
References
Media1
- [1]
“Paralelamente, en septiembre del año pasado la distribuidora de energía eléctrica de la Costa Caribe, Air-e, sufrió un ciberataque de ransomware , lo que interrumpió servicios importantes para sus clientes y afectó sus sistemas internos.”
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.