Rompetrol Hive ransomware attack

On the evening of 6 March 2022, Rompetrol — the Romanian arm of Kazakh state oil major KMG International and operator of Petromidia Navodari, Romania's largest oil refinery — was hit by a ransomware attack. The Hive ransomware gang claimed responsibility and demanded a $2 million ransom, in one of the most significant strikes against Romanian critical energy infrastructure.

What happened

The attack was detected around 21:00 local time and quickly knocked out most of Rompetrol's IT services. The company's corporate websites (both KMG and Rompetrol) went offline, and the Fill&Go automated fuel-payment service — used by both fleet customers and individual drivers at filling stations — became unavailable.

Rompetrol publicly described the incident as a "complex cyberattack." Investigators identified the Hive ransomware-as-a-service operation, which demanded $2 million in exchange for a decryptor and a promise not to publish stolen data. Hive subsequently listed the Rompetrol.org domain on its dark-web negotiation portal, indicating that data exfiltration had occurred before encryption.

Impact

• IT and digital services were widely disrupted: websites, the Fill&Go service, and internal systems.
• Gas stations continued operating throughout, accepting cash and card payments manually.
• The attackers reportedly reached the internal IT network of the Petromidia refinery, but refinery production continued — the company stated operations were not affected.
• Petromidia processes more than five million tonnes of crude annually, supplying a large share of Romania's fuel.

Response

Rompetrol isolated affected systems and worked to restore services over the following days while declining to confirm whether any ransom was paid; there is no public evidence of payment. The separation between IT (business systems) and OT (refinery process control) was the decisive factor that kept the refinery running even as corporate IT was crippled — a key resilience lesson for energy operators.

Why it matters

The Rompetrol attack is a landmark national energy-sector case for two reasons. First, it demonstrated that ransomware can reach the heart of critical fuel infrastructure while still being contained to business IT if OT segmentation holds. Second, coming weeks after Russia's invasion of Ukraine, it sharpened concern across South-East Europe about the exposure of energy operators to financially-motivated and potentially state-adjacent threat groups. Hive itself was later dismantled in a January 2023 FBI-led international operation, but the Rompetrol case remains a reference point for protecting refineries and fuel-distribution networks against extortion.