INA Group ransomware attack

On the evening of 14 February 2020, INA Group — Croatia's largest oil company and operator of its biggest petrol-station chain — was struck by a ransomware attack that encrypted several of its backend IT servers. INA is majority-influenced by Hungary's MOL Group and the Croatian government as its two largest shareholders.

What happened

At roughly 22:00 local time, the Clop ransomware encrypted parts of INA's corporate infrastructure. Clop, first seen in 2019, was actively deployed against European organizations by the financially-motivated threat group TA505. The malware is known to disable security products — including Windows Defender — by altering registry values before it begins encrypting files.

The attack hit back-office systems rather than the point-of-sale terminals that handle fuel purchases. As a result, INA stressed that customers could still buy fuel and pay with cash, INA cards, and bank cards at its stations.

Impact

The encryption knocked out a range of customer-facing and administrative services:

• Loyalty-card registration and use
• Invoice issuance
• Mobile-phone voucher sales
• Electronic vignette (motorway toll sticker) issuance
• Gas-utility bill payments

INA said it was "taking steps to remedy" the disruption and worked to restore the affected systems. The company did not publicly confirm a ransom demand or whether any payment was made.

Why it matters

The INA incident was a prominent example of ransomware striking critical energy infrastructure in Central and Eastern Europe, and it illustrated a recurring lesson: even when operational technology and payment rails stay online, the loss of back-office IT — billing, loyalty, vouchers, statutory e-vignettes — degrades a national-scale service and erodes customer trust.

It also fit the broader TA505 / Clop campaign that targeted large European enterprises in 2019-2020, foreshadowing the group's later pivot to data-theft-plus-extortion tactics, most notably the mass exploitation of the MOVEit file-transfer tool in 2023. For Croatia, the attack on a strategically important, partly state-owned energy company sharpened government and industry attention on protecting essential services against ransomware.