Undisclosed U.S. industrial automation company
March 1, 2025
•[ espionage, manufacturing, technology ]
CISA and the FBI reported that foreign cyber actors on the network of an unnamed U.S. industrial automation integrator serving utilities and transport firms collected about 800 files of customer SCADA data, ICS device details and schematics in March-April 2025.
Power Grid Corporation of India Limited (POWERGRID)
May 2, 2025
•[ hack, ddos, energy ]
On May 2, 2025 NSFOCUS observed an NTP-reflection DDoS attack against POWERGRID public website lasting 31 minutes 26 seconds. Secondary cybersecurity reporting describes temporary website and online-service disruption, while NSFOCUS distinguishes possible online billing or fault-reporting effects from confirmed measurements. No disruption to the physical power grid was reported. No operator was identified; Hacktivist and Protest are inferred from the wider India-Pakistan cyber confrontation.
Uganda Electricity Transmission Company Limited (UETCL)
August 1, 2025
•[ ransomware, energy, hack ]
In August 2025, Uganda Electricity Transmission Company Limited experienced a suspected ransomware incident that compromised monitoring systems for the national electricity transmission network; the service was restored through backup procedures, according to INTERPOL reporting cited in August 2026. Qilin claimed to have breached the utility on August 18, 2025 and to possess contracts, financial statements, identity documents and service agreements, but independent verification of those stolen files, encryption and the precise disruption date is unavailable. No confirmed manipulation of physical grid controls or nationwide blackout was established.
MG Oil Company, Inc.
January 29, 2026
•[ ransomware, leak, energy ]
Akira listed MG Oil Company on January 29, 2026 and claimed theft of approximately 35 GB of corporate data. DataBreach.com subsequently indexed 9,891 associated rows. The company's public attribution, the access vector, and any operational disruption were not established; therefore, only the achieved data-exposure effect is coded.
Sage Water Resources, LLC
March 15, 2026
•[ espionage, energy, malware ]
An advanced nation-state threat actor maliciously modified PLC logic at Sage Water Resources' Blue Bench 13-1 saltwater-disposal facility in Duchesne, Utah on March 15, 2026. The changes bypassed pump shutdown safeguards and allowed pumps to continue running dry while the control system displayed normal operation. A truck driver noticed the abnormal conditions and operators shifted to manual control before equipment failure, environmental damage, or service interruption occurred.
Eversource Energy
April 14, 2026
•[ phishing, social, energy ]
Phishing and social-engineering attacks compromised the credentials of two Eversource Energy employees beginning April 14, 2026. The compromised accounts allowed an unauthorized party to access files containing information belonging to 3,049 customers across Connecticut, Massachusetts, and New Hampshire. Eversource blocked the activity and reported no impact to electric, natural-gas, or water services, customer-information systems, critical operational systems, or infrastructure.
Undisclosed U.S. gas station operators in multiple states
May 15, 2026
•[ espionage, misconfiguration, energy ]
Attackers breached internet-connected automatic tank gauge systems serving gas stations in multiple U.S. states by accessing devices that lacked password protection. The intruders altered displayed fuel-level readings but could not change the actual amount of fuel in the tanks, and no physical damage or safety incidents were reported. U.S. officials suspected Iranian state-sponsored actors, but no specific Iranian group was publicly identified.
ERIELL Group
May 26, 2026
•[ ransomware, energy ]
On or before May 26, 2026, an affiliate of the Nova ransomware operation gained unauthorized access to ERIELL Group and stole corporate data, which the group threatened to publish if the company did not negotiate. Nova subsequently acknowledged that its affiliate had attacked the Uzbekistan-based company, banned the affiliate, claimed that no files were encrypted, and promised not to publish the stolen information.
Reliance Infrastructure Limited
May 29, 2026
•[ ransomware, leak, energy ]
On May 29, 2026, Yotta detected suspicious activity on a hosted server belonging to Reliance Infrastructure, terminated it, and prevented suspected ransomware execution. Reliance confirmed a partial breach of data on the third-party server. World Leaks later published a reported 858,000 Reliance files, including nearly 19,000 files totaling 14.3 GB associated with the Kudankulam project. Reuters could not independently authenticate the documents. NPCIL said the material concerned conventional balance-of-plant facilities rather than nuclear-safety, security, reactor-core, or plant-control systems; there was no reported compromise of NPCIL or plant systems.
Ecopetrol S.A.
June 1, 2026
•[ ransomware, leak, energy ]
An external actor reportedly obtained access through a third party with administrative privileges approximately one month before the incident was disclosed and downloaded files from cloud storage used by 15 Ecopetrol Group companies. Security controls blocked the attempted ransomware encryption, and Ecopetrol reported that operations continued without interruption and that transactional systems were not compromised. The copied information was later published. The Gentlemen claimed responsibility, but Ecopetrol did not publicly confirm the attribution.
Centra Sota Cooperative
June 10, 2026
•[ leak, retail, energy ]
WorldLeaks claimed Centra Sota Cooperative on June 10, 2026. DataBreach.com subsequently indexed 93,417 records containing personal and contact information. Centra Sota is a member-owned agricultural cooperative headquartered in Buffalo, Minnesota, with grain, feed, agronomy, energy, retail and related operations. No independently verified operational disruption has been established.
California Water Service Company
June 11, 2026
•[ hack, espionage, energy ]
On 2026-06-11, the Iran-linked Handala group claimed that it had compromised California Water Service and published a 5 GB proof-of-concept dataset. Dataminr analysis identified customer billing records, RTKBase GPS correction-system credentials, NTRIP passwords, and network details covering at least seven service districts; records associated with the Chico District were independently confirmed. Handala described the operation as retaliation for U.S. actions in Iran and claimed it could disrupt water service, but no access to water treatment or distribution controls and no operational disruption were confirmed. Handala is linked by threat researchers to Iran's Ministry of Intelligence and Security.
Undisclosed Indian government entities
June 12, 2026
•[ espionage, phishing, malware ]
Between June 12 and June 22, 2026, Acronis observed active beaconing from multiple systems compromised by Mustang Panda within Indian government entities, including devices associated with senior administrative personnel. Spear-phishing archives induced users to execute signed Windows applications that sideloaded malicious DLLs and installed SHARDLOADER, MINIRECON, or ZOHOMURK on the endpoints. The malware established persistence, remote command execution, command-and-control, and data-transfer channels through attacker-controlled infrastructure and Zoho WorkDrive. Acronis attributed the campaign to Mustang Panda with high confidence based on tradecraft, malware-code, infrastructure, and development-artifact overlaps and assisted CERT-In with victim notification and remediation. Public reporting associates Mustang Panda with China's Ministry of State Security, although no subordinate bureau, contractor, or operational unit was identified. The operation supported intelligence collection concerning Indian hydropower initiatives and defense cooperation with Taiwan. No operational disruption was reported.
Deep Well Services
June 15, 2026
•[ hack, leak, energy ]
ShinyHunters listed Deep Well Services on June 15, 2026 and claimed theft of customer information and internal corporate data. DataBreach.com later indexed 13,297 rows, while separate analysis identified Salesforce CRM material. Public reporting did not document encryption or operational disruption.
London Hydro
June 18, 2026
•[ leak, misconfiguration, energy ]
London Hydro detected unusual activity involving a customer account on June 18, 2026. Its investigation determined that a technical issue in its website portal allowed an unauthorized third party to access and download information belonging to other customers. London Hydro corrected the issue on the day it was detected. Financial information, dates of birth, government identification numbers, payment-card details, banking information, and passwords were not accessed.
At least one undisclosed Taiwan government agency
July 1, 2026
•[ espionage, government, energy ]
From July 1 to July 4, 2026, attackers used an AI-agent framework to map 21 connected Taiwanese government systems, compromise 85 employee accounts, and extract at least 2,564 personnel-related records across the campaign. The operation also obtained SSO client secrets, database credentials, and internal network information and later scanned government IT vendors, a nuclear safety agency, a government email system, and energy companies. Simplified Chinese operator material and the targeting pattern support state-sponsored intelligence collection, but no named group or actor country has been publicly verified.
Undisclosed United Kingdom gas-fired peaker plant
July 1, 2026
•[ espionage, hack, energy ]
A cyberattack forced an undisclosed approximately 15 MW gas-fired peaker plant in the United Kingdom offline for four days in July 2026. The incident did not affect the wider electricity grid. Multiple reports linked the attack to an Iran-linked state actor, but the UK government and NCSC have not publicly named a specific group. Public reporting does not disclose the precise technical mechanism used to take the generator offline.
Oleoductos del Valle S.A. (Oldelval)
July 1, 2026
•[ ransomware, energy, leak ]
Argentina pipeline operator Oldelval disclosed on July 31, 2026 that a cyber incident affected certain administrative computer systems. It activated response and containment procedures and later reported that the affected platforms had been fully restored, without interruption to crude-oil transport. Ransomware/extortion group The Gentlemen listed the operator on its leak site on July 23 and claimed data theft; the company did not independently confirm exfiltration, encryption, or the attackers identity. The date of initial unauthorized access and full technical effects were not disclosed.
Origin Energy Limited
July 2, 2026
•[ leak, energy ]
Origin Energy confirmed unauthorized access to customer records disclosed in July 2026. An individual using the unverified alias Edison Walthour contacted the company on July 2 claiming to have obtained records, reportedly using a former employee's credentials to access a customer billing platform; Origin initially could not substantiate the claim. After receiving new evidence on July 22, Origin confirmed the breach July 23 and ultimately identified approximately 900,000 affected current and former customers. The claimant threatened public disclosure and later asserted a settlement, neither confirmed by Origin. By August 21 the company had provided individual notifications and said it had no evidence the stolen information had been published. The actual first-access and extraction dates and perpetrator identity remain unverified; no operational disruption was established.
Grand Isle Shipyard
July 6, 2026
•[ ransomware, energy ]
Grand Isle Shipyard, an offshore oil and gas services firm in Galliano, Louisiana, was claimed by the Chaos ransomware group on July 6, 2026, alleging theft of 1.1 TB (341,712 files) from its network servers and setting a negotiation deadline. No company statement.
