Oltenia Energy Complex (Complexul Energetic Oltenia) hit by ransomware attack
Incident
Summary
Hide ▲
Show ▼
A ransomware attack hit Oltenia Energy Complex and encrypted files while taking key business systems offline, disrupting operations during the holiday period. ERP, document management, email, and the website were temporarily unavailable, and the company said activity was partially affected. The operator is restoring systems from backups and checking whether data was stolen before encryption. The incident matters because the company supplies about 30% of Romania's electricity.
Related Happenings
Gentlemen ransomware affiliate campaign expanding toolkit and infrastructure
Campaign
First: 20.04.2026 23:02
Last: 20.04.2026 23:02
Sources 1
How related:
The Gentlemen ransomware operation surfaced in August and is known for using compromised credentials and targeting Internet-exposed services to gain initial access to victims' networks.
About this happening:
The **Gentlemen ransomware** campaign has now been tied to a **ransomware attack on Oltenia Energy Complex** on the **second day of Christmas**, disrupting **ERP systems**, **docu...
Gentlemen ransomware affiliate campaign expanding toolkit and infrastructure
CampaignHow related: The Gentlemen ransomware operation surfaced in August and is known for using compromised credentials and targeting Internet-exposed services to gain initial access to victims' networks.
About this happening: The **Gentlemen ransomware** campaign has now been tied to a **ransomware attack on Oltenia Energy Complex** on the **second day of Christmas**, disrupting **ERP systems**, **docu...
Conpet hit by data theft breach linked to Qilin
Incident
First: 05.02.2026 17:15
Last: 05.02.2026 17:15
Sources 1
About this happening:
**Conpet** disclosed a **cyberattack** that disrupted its **business systems** and took its website offline, creating operational risk for Romania's national oil pipeline operator...
Conpet hit by data theft breach linked to Qilin
IncidentAbout this happening: **Conpet** disclosed a **cyberattack** that disrupted its **business systems** and took its website offline, creating operational risk for Romania's national oil pipeline operator...
Romanian Waters (Administrația Națională Apele Române) hit by ransomware attack
Incident
First: 22.12.2025 17:25
Last: 22.12.2025 17:25
Sources 1
About this happening:
**Romanian Waters** (**Administrația Națională Apele Române**) was hit by a **ransomware attack** that disrupted about **1,000 systems** across **10 of 11 regional offices**, whil...
Romanian Waters (Administrația Națională Apele Române) hit by ransomware attack
IncidentAbout this happening: **Romanian Waters** (**Administrația Națională Apele Române**) was hit by a **ransomware attack** that disrupted about **1,000 systems** across **10 of 11 regional offices**, whil...
Capita hit by ransomware attack
Incident
First: 15.10.2025 12:00
Last: 15.10.2025 12:00
Sources 1
About this happening:
**Capita** suffered a **2023 ransomware intrusion** after an employee device infection let the attacker move laterally, lock out staff, and steal sensitive data. The breach matter...
Capita hit by ransomware attack
IncidentAbout this happening: **Capita** suffered a **2023 ransomware intrusion** after an employee device infection let the attacker move laterally, lock out staff, and steal sensitive data. The breach matter...
Timeline
-
29.12.2025 16:26 2 articles · 4mo ago
Gentlemen ransomware disrupts Oltenia Energy Complex
Initial DisclosureGentlemen ransomware hit Oltenia Energy Complex, Romania's largest coal-based energy producer, on the second day of Christmas, encrypting some documents and files and temporarily disabling ERP systems, document management applications, the company's email service, and the website. The company said its activity was partially affected without jeopardizing the National Energy System, IT teams began rebuilding affected systems on a new infrastructure using existing backups, the incident was reported to the National Cyber Security Directorate, the Ministry of Energy, and DIICOT, and the company was still assessing whether data was stolen before encryption.
Show sources
- Romanian energy provider hit by Gentlemen ransomware attack — www.bleepingcomputer.com — 29.12.2025 16:26
- Romanian energy provider hit by Gentlemen ransomware attack — www.bleepingcomputer.com — 29.12.2025 16:26