Incidents in sector:
Colorado officials disclosed that foreign actors breached the control systems of two small water utilities, altering equipment settings and disabling alarms before the intrusions were contained.
CenterPoint Energy confirmed unauthorized access to customer data through an external system after a hacker claimed to have pulled 7.49 million records from an API lacking authentication.
Bavarian municipal utility Stadtwerke Landsberg reported that ransomware encrypted its central IT systems overnight on 1 September 2026, disrupting phone and email contact while electricity, water, wastewater and district heating continued to run.
Kansas-based water and wastewater control-systems supplier Micro-Comm was hit by the Barracuda ransomware group, which claimed to have stolen roughly 644 GB of data, prompting FBI scrutiny amid heightened concern over attacks on the U.S. water sector.
The UK government confirmed that a cyberattack knocked a small-scale energy generator offline for four days, in what was reported as the first disruptive Iranian-linked cyberattack of its kind in Britain, alongside attacks on U.S. water utilities.
A hacking operation using AI agents compromised 85 Taiwanese government accounts and extracted more than 2,500 personnel records in July 2026 before probing the nuclear safety agency and energy companies; Taiwan's digital ministry confirmed the attack.
Denver-based oil and gas producer SM Energy began notifying individuals on 30 July 2026 that a spring 2026 network intrusion had exposed personal data including Social Security numbers.
Origin Energy told the ASX it was investigating a cyberattack, then confirmed unauthorised access to some customers' data in a breach later put at around 900,000 people.
Ecopetrol disclosed that intruders accessed cloud-based file storage across 15 of its subsidiaries and stole data linked to roughly 3,300 accounts, while a separate ransomware attempt was blocked by its security controls.
The extortion group World Leaks leaked roughly 19,000 files tied to India's Kudankulam nuclear plant, taken from what Reliance Group called a partial breach of its data at a third-party data centre.
Attackers used a customer account to exploit a system vulnerability at Canadian utility London Hydro, potentially accessing the names, contact details and account information of other customers.
A dataset dubbed FortiBleed exposed valid Fortinet FortiGate VPN credentials — including plaintext passwords — for 73,932 firewall URLs across 194 countries, the product of a Russian-speaking crew that reused passwords from earlier breaches and infostealer logs rather than any new Fortinet vulnerability.
Iran-linked hacktivist persona Handala claimed to have breached California Water Service, one of the largest U.S. investor-owned water utilities, leaking about 5 GB of customer billing data and credentials as retaliation for U.S. strikes in Iran; Cal Water found no disruption to water operations.
On 11 May 2026, French renewable-energy cooperative Enercoop suffered a security incident in which email addresses tied to customer, prospect and member accounts were compromised and abused to send fraudulent phishing messages impersonating its customer service.
In April 2026, the Coinbase Cartel extortion group listed French energy giant Engie on its dark web leak site, claiming to have stolen sensitive data and threatening to publish a full dump unless a ransom was paid; Engie did not publicly confirm the breach.
In December 2025, the French operations of Italian energy group ENI suffered a data breach claimed by the Lapsus$ group, exposing professional contact details for tens of thousands of business customers; ENI confirmed the incident and notified the CNIL.
On 28 February 2025, a threat actor claimed to have stolen a database from EDF's hydraulic generation division (DPIH), exposing power-plant intervention and maintenance plans, security inspection results and maintenance staff IDs; EDF and researchers disputed the actor's nuclear claims.
In January 2025, E.Leclerc's Prime énergie (energy-rebate) platform was hit by fraudulent account access, exposing customers' names, email addresses, login credentials, file numbers, rebate amounts and service descriptions; the breach was disclosed to affected users on 24 January 2025.
The Lynx ransomware gang breached Electrica Group, one of Romania's largest electricity suppliers serving 3.8 million users, disrupting customer-facing services while SCADA and other critical grid systems were isolated and kept running.
RansomHub ransomware forced Costa Rica's state oil refiner RECOPE to switch its entire fuel-distribution network to manual operations, triggering the first real-world deployment of the U.S. State Department's FALCON cyber-response program.
In November 2024, the German electricity provider Tibber suffered a data breach that exposed the personal information of 50k customers. The data included names, email addresses, geographic locations (city and postcode) and total spend on purchases.
RansomHub gained access to Halliburton's systems, prompting the oil-services giant to take infrastructure offline. The incident delayed invoicing and purchase orders, and Halliburton booked a $35 million loss in its SEC filings.
Cactus ransomware operators hit Schneider Electric's Sustainability Business division, taking the Resource Advisor consulting platform offline and exfiltrating approximately 1.5 TB of data — including passport scans and signed NDAs from customers like Hilton, PepsiCo, and Walmart.
In November 2023, the kitchen management application KitchenPal suffered a data breach that exposed 146k lines of data. When contacted about the incident, KitchenPal advised the corpus of data came from a staging environment, although acknowledged it contained a small number of users for debugging…