City of Plymouth Water and Sewer Utility
July 26, 2026
•[ hack, espionage, energy ]
Beginning at approximately 7:30 p.m. on July 26, 2026, Plymouth lost SCADA communications with cellular-connected programmable logic controllers at two water towers and 14 sanitary-sewer lift stations. A second facility stopped communicating shortly after midnight, prompting a coordinated response. The city disconnected affected equipment, used manual site checks and procedures, hard-reset and secured systems location by location, and restored normal communications by the afternoon of July 28. Water levels, pressure, treatment, quality, and delivery remained unaffected. No data theft, ransom demand, or specific actor was disclosed. U.S. intelligence agencies preliminarily assessed that Iran was likely responsible for the coordinated Minnesota campaign, but attribution was not final.
Novum Energy Trading, Inc.
July 26, 2026
•[ ransomware, energy ]
Global Secret Group listed Novum Energy on July 26, 2026 and threatened publication unless the company negotiated. DataBreach.com's verified searchable dataset confirms a data compromise. No public victim statement, regulator notice, or incident-specific report confirming encryption, unavailable systems, or interrupted trading or logistics operations was located as of August 12, 2026.
Undisclosed United States water or wastewater utility
July 30, 2026
•[ hack, energy, government ]
An FBI/EPA advisory identifies at least one utility that found modified PLC project files and ladder-logic discrepancies across several sites. This row represents that specific anonymized victim, not all utilities in the campaign reported since July 27, 2026. Its occurrence date is undisclosed; July 30 is the advisory-publication fallback. Campaign-wide reports of flooding, pressure loss and loss of control are not assigned to this utility without victim-specific evidence. No actor or data theft was identified.
Shell
August 13, 2026
•[ ransomware, energy ]
Russian ransomware group Clop claimed in Aug 2026 to have stolen 89 GB of Shell data, including technical drawings, facility images and project plans, listing the energy company among dozens of new victims. Shell said it was aware of a potential incident and was investigating.
National Grid plc
August 15, 2026
•[ hack, leak, energy ]
A hacker published an approximately 40GB archive of National Grid technical material on a cybercrime forum. National Grid acknowledged a data compromise associated with a software supply chain attack earlier in 2026 but said it found no current evidence of impact to operations, internal systems, or customer or employee information. The precise compromised third party and acquisition method were not identified.
Delek US Holdings, Inc.
August 19, 2026
•[ ransomware, leak, energy ]
Helix listed Delek US on its extortion site on August 19, 2026 and claimed possession of customer and employee information. DataBreach.com subsequently indexed 122,079 leaked records containing personal and contact information. Delek US has not publicly confirmed the incident, and no operational disruption has been independently established.
CenterPoint Energy
September 14, 2026
•[ leak, hack, energy ]
Houston-based utility CenterPoint Energy said in a Sep 14, 2026 SEC filing that an unauthorized party took customer personal data via an external-facing system, after a hacker leaked a 2.5 GB archive claimed to hold 7.5M records. Power and gas service were unaffected.
Electro Heat Sweden AB
October 2, 2026
•[ ransomware, manufacturing, energy ]
Electro Heat Sweden AB was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-10-02. Sector: Energy & Utilities. Country: Sweden. Electro Heat Sweden AB ElectroHeat industrial furnaces are used in manufacturing industries all over the world.Files: 1,723,527Data volume: 2,55 TBAll intellectual property - SolidWorks CAD designs of every product, backups of the PDM drawing vault.All accounting and payroll - Visma databases and SPCS payroll databases of four legal entities.Legally sensitive material - confidential settlement agreement with ABB for a $75,000 payment, liquidated-damages dispute correspondence, cost-pricing calculations.Employee personal data - passport details, visa applications (passport, address, phone, DOB ), insurance policies.Contracts and acceptances - signed agreements and acceptance certificates with Hitachi, ABB, Scania and other customers. More
Sangre de Cristo Electric Association
October 1, 2026
•[ ransomware, energy, leak ]
Sangre de Cristo Electric Association was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-10-01. Sector: Energy & Utilities. Country: United States of America. Website: myelectric.coop. Sangre de Cristo Electric Association (SDCEA) has been informed that a substantial volume of sensitive information has been compromised. The affected information includes customer personally identifiable information, financial and payment data, utility account information, and information associated with the organizations energy infrastructure and operational technology environment.
The information includes details concerning electrical distribution infrastructure, substations, transformers, feeders, operational systems, renewable-generation assets, outage information, and SCADA/EMS-related environments. The compromise data also include highly sensitive authentication and security information, including control-system credentials, API keys, and OT security configurations.
We previously proposed resolving the incident through a peaceful and confidential process. According to our account, negotiations were subsequently discontinued after SDCEA CEO Jon Beyer indicated that the organization had decided to end discussions. As a result, we are issuing this public statement concerning the incident.
In addition, we will take further disruptive actions to ensure that, in the future, those responsible for making these decisions approach the security of the resources entrusted to themincluding the people within their area of responsibilitywith greater awareness and seriousness.
PT Indo Tambangraya Megah
September 12, 2026
•[ ransomware, leak, energy ]
PT Indo Tambangraya Megah was listed as a victim on the leak site of the ransomhouse ransomware group; the attack is estimated to have taken place on 2026-09-12. Sector: Energy & Utilities. Country: Indonesia. Website: www.itmg.co.id. PT Indo Tambangraya Megah, founded in 1987, is a leading coal producer based in Asia. The company focuses on maintaining high standards in corporate governance, environmental practices, and workplace safety. PT Indo Tambangraya Megah operates with a commitment to collaboration with local communities and stakeholders. The company has established a diverse customer base in the mining industry and offers various services related to coal production.
Mabris
October 6, 2026
•[ ransomware, manufacturing, energy ]
Mabris was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Country: France. Website: mabris.fr. mabris.fr) zoominfo.com/c/mabris/513443412MABRIS is a French family-owned industrial contractor based in Saint-Pierre-la-Cour (Mayenne), founded in the 1980s and registered as an SAS in 1999, with a second workshop in Airvault under the OPTEOR banner since 2006. It provides end-to-end services boilerwork (chaudronnerie), industrial piping, metalwork, and industrial mechanics/maintenance split ~60% maintenance / 40% design, with an in-house design office using AutoCAD, SolidWorks, and 3D point-cloud scanning. Working B2B-only across 18 departments in western France (zero export), it serves chemical, food, and energy industry clients, and partners with neighboring firm AROM for tungsten-carbide hardfacing (whose facility it acquired in 2022 for 45,000). Led by president Jacques Belaud since 2011, it employs ~26 people and holds MASE safety certification (renewed November 2025). Financially it staged a strong turnaround: revenue grew from 6.37M (2021) to a record 7.97M (2024)
PIC GROUP, INC
September 15, 2026
•[ ransomware, energy, manufacturing ]
PIC GROUP, INC was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-15. Sector: Other. Country: United States of America. Website: picgroupinc.com. PIC Group, Inc. is dedicated to delivering value by providing Operation & Maintenance, Commissi
oning and Startup, Documentation & Training and Staffing services to the power generation, oil
and gas, petrochemical, pulp and paper and manufacturing industries globally.
We will upload 8gb of corporate data soon. Employee information, projects (drawings, specificat
ions), clients info, contracts and agreements and so on.
Greentech Environmental
October 12, 2026
•[ ransomware, energy, manufacturing ]
Greentech Environmental was listed as a victim on the leak site of the interlock ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Energy & Utilities. Website: https:greentechenv.com. Greentech Environmental LLC, a manufacturer of air purification systems using patented ODOGard and ARC technologies, has failed to fully secure and address the breach, and therefore we are publishing their confidential information such as (intellectual property/trade secrets, financial statements, employee data, operational/strategic plans, legal documents, corporate governance documents, and manufacturing drawings) that would violate the Defend Trade Secrets Act (CFAA) and state privacy laws, which would subject us to injunctive relief, treble damages, penalties, mandatory notification, class action lawsuits, loss of patent rights and competitive advantage, and possible business failure.
TGN
October 6, 2026
•[ ransomware, energy ]
TGN was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Country: Argentina. Website: tgn.com.ar. tgn.com.ar zoominfo.com/c/transportadora-de-gas-del-norte/372392284 Transportadora de Gas del Norte (TGN) is Argentina's largest natural gas transporter, publicly traded on BYMA (TGNO4), founded in 1992 and operating 11,317 km of pipelines and 22 compressor stations across 17 provinces. It moves 40% of all natural gas in Argentina's pipeline system (~20% of the national energy matrix) and is the only operator connecting Argentina to Chile, Brazil, Bolivia, and Uruguay. FY2025 revenue was ~$483M (AR$600.6B, +20%), EBITDA ~$260M (55% margin), and net income surged +351% to ~$176M, driven by tariff reforms and Vaca Muerta export growth. The company has virtually zero debt (Debt/EBITDA 0.2x), $250M cash, and pays record dividends of AR$577/share (~10% yield), with a AA-(arg) credit rating (Fitch, positive outlook). It employs 6001,153 people, is controlled by Gasinvest (56%) a Techint/Tecpetrol + CGC/Eurnekian joint venture and was named a Great Place to Work Top-25 in Argentina 2025
Aquatech
October 6, 2026
•[ ransomware, energy, technology ]
Aquatech was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Energy & Utilities. Country: United States of America. Website: aquatech.com. aquatech.com zoominfo.com/c/aquatech-international-llc/2523742 Aquatech International Corporation is a private water treatment technology company founded in 1981 and headquartered in Canonsburg, Pennsylvania, with operations in 26 countries and 1,000+ projects across 60+ countries. It generates estimated annual revenue of $105165M and employs 9001,368 people globally (growing +31% per year). Aquatech is the world's leading Zero Liquid Discharge (ZLD) provider (160+ installations) and a major desalination player its Corpus Christi, Texas plant (30 MGD) will be the third-largest SWRO facility in the Americas. The company won the prestigious "Water Technology Company of the Year 2025" (Global Water Awards) and acquired three companies in 2025 (Century Water, Koch Li-Pro DLE, FTS H2O) to dominate lithium extraction (PEARL platform) and ultrapure water for semiconductors. Led by CEO Devesh Sharma and President/CTO Ravi Chidambaran, with a private equity investor entering in 2025.
Supreme Energy
October 9, 2026
•[ ransomware, energy ]
Supreme Energy was listed as a victim on the leak site of the Panzer ransomware group; the attack is estimated to have taken place on 2026-10-09. Sector: Energy & Utilities. Country: Indonesia. Supreme Energy is an Indonesian renewable-energy company that develops geothermal power projects to generate clean electricity.
Eversource Energy
October 12, 2026
•[ ransomware, energy ]
Eversource Energy was listed as a victim on the leak site of the Redact ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Energy & Utilities. Country: United States of America. Website: eversource.com. Sector: Energy Distribution | Revenue: $14B USD
Prodiel
October 12, 2026
•[ ransomware, energy ]
Prodiel was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Energy & Utilities. Country: Spain. Website: www.prodiel.com.
Royal EGT
July 12, 2026
•[ ransomware, energy ]
Royal EGT was listed as a victim on the leak site of the nightspire ransomware group; the attack is estimated to have taken place on 2026-07-12. Sector: Energy & Utilities. Country: Egypt. Website: www.egt.com.
Dudley Land Company
October 9, 2026
•[ ransomware, energy ]
Dudley Land Company was listed as a victim on the leak site of the bravox ransomware group; the attack is estimated to have taken place on 2026-10-09. Sector: Other. Country: United States of America. Website: www.dudley-land.com. Dudley Land Company, Inc. is a U.S. land-services company founded in 1980 and headquartered in Oklahoma City, Oklahoma. For more than four decades, it has supported energy and infrastructure projects across the United States.
