Oil or fuel facility

Halliburton — RansomHub ransomware

21 August 2024

United States (Houston, Texas headquarters)

What happened

Halliburton, one of the world's largest oilfield services companies, detected unauthorized access to its corporate IT systems and proactively took certain applications offline, including production-planning and shipment-tracking systems used in customer service delivery. The company disclosed the incident to the SEC on 23 August 2024 and later confirmed data had been exfiltrated. Halliburton reported roughly $35 million in expenses and lost or delayed revenue, about $0.02 per share, while stating the incident was not reasonably likely to have a material impact on its financial condition. The compromise affected corporate IT rather than operational technology at wellsites, and no disruption to physical energy production was reported. The marker is placed at the company's Houston headquarters.

When cited sources give different casualty, damage or spill figures for this event, they’re reported side by side above rather than merged into one number. See how confidence levels work.

Evidence
Documented
Confidence
High
Infrastructure
Oil or fuel facility
Latitude
29.7270°
Longitude
-95.3980°

Attribution

Attributed to RansomHub ransomware group

RansomHub listed Halliburton on its leak site within days. Halliburton's SEC filings confirmed unauthorized access and data exfiltration without naming the group.

Sources

  1. Halliburton reports $35 million loss after ransomware attackBleepingComputer, citing Halliburton SEC filings · Incident reporting