Loading story…
Romania’s national oil pipeline operator Conpet confirmed a cyberattack that disrupted parts of its corporate IT environment and rendered its public website inaccessible, while stating that core oil transport operations were not impacted. Conpet reported that its operational technology environment—including SCADA and telecommunications systems—remained fully functional, and said it took immediate mitigation steps, engaged Romania’s national cybersecurity authorities to support the investigation and recovery, and filed a criminal complaint.
The Qilin ransomware operation (a Russian-speaking ransomware-as-a-service group) claimed responsibility by listing Conpet on its leak site and alleging theft of nearly 1 TB of data; the group posted samples it says are internal documents, including financial records and passport scans. Reporting characterized Qilin as a highly active and destructive actor with prior victims across public and private sectors internationally, and noted the incident occurs amid a broader pattern of ransomware activity affecting Romanian organizations and critical services.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-02-05, the Qilin ransomware group added Conpet to its Tor-based leak site and claimed responsibility for the attack. The gang alleged it had stolen about 1 TB of sensitive data and published sample files, including financial information and passport scans, as proof.
In a statement issued on 2026-02-04, Conpet publicly confirmed the cyberattack and said the incident did not affect operational activity, company stability, or its ability to meet contractual obligations. The company reiterated that the National Oil Transport System remained safe and fully functional.
On the day of detection, Conpet activated mitigation measures, began investigating with Romania’s national cybersecurity authorities, and filed a criminal complaint with DIICOT. The response was aimed at containing the incident while maintaining normal transport operations.
On 2026-02-03, Romania’s national oil pipeline operator Conpet detected a cyberattack that disrupted parts of its business IT infrastructure and temporarily took its public website offline. The company said operational technology, including SCADA and telecommunications systems, continued functioning normally and oil transport operations were not disrupted.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcedatabreaches.net
Open sourcescworld.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Romania’s national oil pipeline operator **Conpet** reported a cyberattack that disrupted corporate IT services and took its public website offline, while stating that operational technology (including pipeline control and telecommunications systems) remained functional and oil transport continued. The **Qilin** ransomware group claimed responsibility, and reporting indicated the actor alleged data theft on the order of **~1TB**, publishing purported proof such as internal documents, financial records, and scanned passports on its leak site. Separate reporting described an unrelated cloud-focused cybercrime campaign attributed to **TeamPCP** (aka **PCPcat** / **ShellForce**), which has been compromising exposed and misconfigured cloud management interfaces at scale using automated, worm-like propagation. The activity was assessed as leveraging broad scanning and “industrialized” use of known weaknesses and misconfigurations (rather than novel exploits) to hijack infrastructure and monetize access, with claims of at least **~60,000** servers compromised globally since late December.
Jun 29, 2026
Ransomware monitoring sources recorded a surge of victim claims led by **Qilin**, which posted attacks against organizations in the United States, Argentina, France, Italy, Peru, Brazil, Turkey, and the United Kingdom. Named victims included **Cafar**, **Droguería Martorani**, **AK Preparedness**, **Armara**, **Sicc**, **KLD Labs**, **St Martha Catholic Church**, **Salina Supply**, **The Nueva School**, **City Ambulance Service**, **Famesa**, **Associated Theatrical Contractors**, **Don Tortaco Mexican Grill**, **Eana**, **PP+K**, **Synergy Products**, and **Bolt & Nut Manufacturing**. The affected sectors spanned healthcare, education, manufacturing, agriculture and food production, hospitality, technology, business services, and religious organizations, underscoring broad opportunistic targeting rather than a single-industry campaign. Other groups also continued to post new victims. **Incransom** claimed attacks on **v-silicon.com** in Taiwan, **Reatile Group** in South Africa, **Vedan Corp** in Vietnam, and **V&P Nurseries** in the United States; **DragonForce** claimed **NewNet S.A.** in Colombia and separately threatened Switzerland's **Ifage** with publication of **850 GB** of allegedly stolen data after an earlier intrusion; **Krybit** listed **Euroins Insurance Company AD** in Bulgaria; and **Akira** claimed **McKeever, Varga & Senko** in the United States, alleging theft of **12 GB** of corporate and personal data. A weekly ransomware trend report based on **eCrime.ch** data counted **187** claims for the period, down from **233** the prior week, but still identified **Qilin** as the most active group with **33** claims, ahead of **DragonForce** with **27**.
Jul 21, 2026
Oltenia Energy Complex, Romania's largest coal-based energy producer, suffered a ransomware attack attributed to the Gentlemen ransomware group. The incident, detected on December 26, resulted in the encryption of documents and files, and caused temporary unavailability of critical IT applications, including ERP systems, document management, email services, and the company website. Despite the disruption, the operation of the National Energy System was not jeopardized, and the company's activity was only partially affected. Upon discovery, the affected systems were isolated and IT teams began rebuilding infrastructure using existing backups. The company reported the incident to the National Cyber Security Directorate, the Ministry of Energy, and filed a criminal complaint with law enforcement agencies. Investigations are ongoing to determine the full impact and whether any data was exfiltrated prior to encryption. The Gentlemen ransomware group is known for exploiting compromised credentials and targeting internet-exposed services, deploying ransom notes and encrypting files with the `.7mtzhh` extension.
Jun 29, 2026