⚡ Energy & Utilities

Oil & gas, power, water, energy services — OT-heavy critical infrastructure · a shareable slice of the daily brief for stakeholders who only care about this industry · RSS feed

Victims L30D3▼ −2

Prior 30D5

Active actor L90DUnknown · 3

Active actor L90DAkira · 1

Active actor L90DRedact · 1

Today — 03 Nov 2026

No industry-tagged items in today's briefing — see recent activity below.

Last 14 days

ENGIE confirms customer data exposed via a partner marketing platform — a lead this desk flagged unconfirmed on Oct 28 now clears the bar.HighEnergy & UtilitiesThe French energy group told BleepingComputer (Oct 27) that attackers compromised a marketing/prospecting platform used by business partners, not ENGIE's own internal systems; the incident is limited to customers in France (no count given). Exposed fields are names, mailing/email addresses, phone numbers and certain energy-contract details — no banking data. ENGIE cut off the attackers' access, notified authorities and is contacting affected customers; no actor has come forward publicly. BleepingComputer

Recent victim claims

Newest first, mapped to this industry from the victim database. Most are leak-site claims — verify before acting.

October 2026

Oct 13 PIC Group Akira Ransomware · energy services · USA Akira ransomware group listed PIC Group, Inc., a Georgia-based power-generation plant operations and maintenance services provider, on its leak site. No independent confirmation, company statement, or disclosed data volume found beyond the aggregator listing; treat as an unverified claim. · Sources: Breachsense

Oct 13 Eversource Energy Redact Ransomware · energy / utilities · USA Redact ransomware group claimed Eversource Energy, a major US electric and gas utility serving Connecticut, Massachusetts and New Hampshire, on its leak site. Leak size undisclosed; no company statement, regulatory filing, or mainstream press corroboration found beyond breach-tracking aggregators. Treat as an unverified claim; verify before treating as a confirmed breach given the critical-infrastructure profile. · Sources: DeXpose · Breachsense

Oct 05 Southern Company (Georgia Power / Alabama Power / Mississippi Power) Unknown Ransomware · energy · USA Unauthorized party accessed the online customer portal and viewed limited account information (names, addresses, phone/email, last-4 SSN digits) for ~400,000 accounts -- ~300,000 Georgia Power, ~100,000 split across Alabama Power and Mississippi Power. No full SSNs, bank/card numbers or driver's license numbers per the company; no evidence of ongoing access. One year of Equifax credit monitoring offered. · Sources: AJC · WSB-TV

September 2026

Sep 28 ATCO Ltd Medusalocker Ransomware · Energy · Canada Listed on Medusalocker's leak site; claim covers ~80 extracted emails, a small volume relative to the scale of the Calgary-based energy/utilities conglomerate this name usually refers to. Entity identity is unresolved: aggregator coverage separately references a distinct 'ATCO Products Inc' (a smaller automotive-parts manufacturer) in connection with Medusa/Medusalocker activity around the same date -- this record reflects the ransomware.live listing's own victim name, unconfirmed by any company statement. · Sources: Ransomware.live

Sep 24 GDM Pipelines Qilin Ransomware · energy · United Kingdom UK pipelines/energy-industrial firm listed on Qilin's leak site; no company confirmation. · Sources: Ransomware.live

Sep 22 Nam Theun 2 Power Company SETTRA Ransomware · energy (hydropower) · Laos SETTRA listed namtheun2.com, operator of Laos's largest hydropower dam, on its leak site claiming roughly 1.2TB of internal files exfiltrated in a Sep 11 incident; no company confirmation. OT-adjacent critical-infrastructure target worth tracking for downstream power-grid impact if corroborated. · Sources: RedPacket Security · GalaxyWarden

Sep 20 Siddhi Green Excellence Pvt. Ltd. Orova Ransomware · energy / utilities · India Orova listed Siddhi Green Excellence, an Indian energy/utilities firm, on its leak site Sep 20. No data scope or company confirmation disclosed. DLS claim only. · Sources: RedPacket Security

Sep 15 CenterPoint Energy Unknown Ransomware · Energy / Utilities · USA CenterPoint Energy, the Houston-based electric and gas utility serving roughly 7 million metered customers across Texas, Indiana, Minnesota and Ohio, confirmed via a Sep 14 SEC 8-K that an unauthorized third party obtained customer data through a company-managed API. The disclosure follows a Sep 1 dark-web forum post by an actor using the alias 4d722e4d656f77 claiming theft of 7.49 million raw records (names, phone numbers, emails, billing/service addresses, account and premise identifiers, billing amounts, autopay status, and last-four SSN digits); CenterPoint has not confirmed that figure or the leaked dataset's authenticity. No operational/grid impact reported. · Sources: https://www.securityweek.com/texas-utility-centerpoint-energy-confirms-breach-after-hacker-leaks-data/

August 2026

Aug 22 RXPE Group CoinbaseCartel Ransomware · Energy · China CoinbaseCartel DLS claim Aug 22 2026; RXPE Group (rxpe.com) is a Chinese energy company; data-theft extortion with 48h contact window, 10-day payment deadline; data scope unconfirmed; 🟥 unverified DLS claim · Sources: DEXpose

Aug 22 Vietnam Electricity (EVNHANOI) Emperador Ransomware · Energy / Utilities · Vietnam Emperador ransomware DLS claim Aug 22 2026; EVNHANOI is Vietnam's Hanoi Electricity Corporation, a state-owned critical infrastructure entity; Emperador is a lower-profile group with limited prior reporting; data scope unconfirmed; 🟥 unverified DLS claim · Sources: RansomLook

Aug 13 Shell Clop Extortion · Energy · NLD Clop listed Shell on DLS as part of mass PTC Windchill/FlexPLM campaign (CVE-2026-12569); claimed 89GB of engineering drawings, facility scans, test reports and project plans. Shell confirmed it is investigating a potential incident. DLS claim — breach not confirmed. · Sources: https://www.technadu.com/shell-and-philips-confirm-investigation-following-cl0p-data-theft-claims-targeting-nearly-50-companies-including-fiserv-and-ge/633182/

Aug 09 Siam Oil Product Co. Ltd. Unknown Ransomware · Energy / Petroleum · THA DLS claim posted August 9 on ransomware.live; Thai petroleum and industrial distributor; group attribution not confirmed in available sources · Sources: https://www.ransomware.live/

July 2026

Jul 26 Multiple Minnesota Water and Wastewater Utilities (30+) CyberAv3ngers Ransomware · Critical Infrastructure · US Coordinated OT attack on 30+ community water and wastewater systems including Plymouth, South St. Paul, Braham, and Maple Plain; automated control functions disrupted, some systems switched to manual; no water quality impact reported; MNIT activated statewide incident response; FBI investigating; pattern matches CyberAv3ngers/Iranian ICS tradecraft · Sources: https://www.bleepingcomputer.com/news/security/hackers-target-over-30-minnesota-water-utilities-in-coordinated-ot-attack/ · https://www.securityweek.com/dozens-of-minnesota-water-utilities-targeted-in-coordinated-ot-attacks/

Jul 23 Origin Energy Unattributed Breach · Energy / Utilities · Australia 4.8 million customer records breached; names, addresses, DOBs, phone numbers, partial payment card/bank account details. Company engaged ACSC and Australian Federal Police. · Sources: https://therecord.media/australia-origin-energy-data-breach

Jul 18 Reatile Group INC Ransom Ransomware · energy (industrial/energy distribution) · South Africa INC Ransom DLS posting July 18; data claimed exfiltrated; unverified — no public statement from Reatile Group · Sources: https://www.ransomware.live

Jul 17 Acosol Qilin Ransomware · utilities (water) · Spain Spanish public water utility; Qilin DLS claim Jul 17, 2026; company confirmed cyberattack, activated security protocols, warned subscribers personal data including national ID numbers, contract info, and payment methods may be compromised; NIS2-classified critical infrastructure · Sources: https://www.ransomware.live/id/QWNvc29sQHFpbGlu · https://www.hendryadrian.com/acosol-suffers-cyberattack-urges-customers-to-stay-alert/

Jul 17 Ecopetrol Unattributed Breach · energy (oil and gas) · Colombia Colombia's national oil company; unauthorized access to cloud-based file storage environments of approximately 15 subsidiaries; data from ~3,300 user accounts exfiltrated including financial records, customer data, and internal files; ransomware encryption attempt blocked by existing controls; external actor communicated extortion demands; no data published on leak sites as of July 20; criminal complaint filed with Colombian Attorney General; investigation ongoing with insurers and outside experts · Sources: https://www.prnewswire.com/news-releases/ecopetrol-reports-cybersecurity-incident-302828952.html https://colombiaone.com/2026/07/18/colombia-cyberattack-company-ecopetrol/

June 2026

Jun 26 Salters Propane SpaceBears Ransomware · energy · propane distribution/US propane fuel distributor; SpaceBears DLS claim June 26, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.redpacketsecurity.com/ · https://www.hendryadrian.com/ · Sources: [RedPacket Security] · [hendryadrian.com]

Jun 15 Deep Well Services ShinyHunters Extortion · oilfield services · US provider of downhole tools and services to the oil and gas industry; 7,000+ customer PII and internal corporate data records claimed; ShinyHunters DLS June 15, 2026; ransom deadline June 18 passed without data publication at time of initial report; no victim statement · https://www.hookphish.com/blog/ransomware-group-shinyhunters-hits-deep-well-services/ · https://www.ransomware.live/id/RGVlcCBXZWxsIFNlcnZpY2VzQHNoaW55aHVudGVycw · https://breachnews.com/breaches/kodak-and-deep-well-services-added-to-shinyhunters-leak-site/ · Sources: [HookPhish] · [ransomware.live] · [BreachNews]

Jun 05 Trican Well Service Qilin Ransomware · oilfield services · Canada Sources: ransomware.live DLS

Jun 01 Energy Action SafePay Ransomware · energy management · Australia ~470GB claimed; under investigation · Sources: SafePay DLS

---

← All industries · Victim database →