Conpet ransomware attack: Romanian oil pipeline operator confirms cyber incident

The Conpet ransomware attack has raised concerns about cybersecurity risks facing critical infrastructure operators in Romania. The national oil pipeline operator confirmed a cyber incident that disrupted its business IT environment and temporarily took its public website offline. Despite the breach, oil transport operations continued without interruption.

The disclosure adds to a growing list of ransomware incidents affecting energy and utility organizations across Europe.

What Happened During the Cyberattack

Conpet detected unauthorized activity within its corporate IT systems earlier this week. The company confirmed that attackers targeted internal business infrastructure rather than operational technology. As a precaution, Conpet took several systems offline while it began investigation and recovery efforts.

The company reported that crude oil transport and fuel distribution continued as normal throughout the incident. Pipeline operations, monitoring systems, and telecommunications infrastructure remained stable.

Ransomware Group Claims Data Theft

The attackers behind the Conpet ransomware attack later claimed responsibility and alleged that they exfiltrated a large volume of internal data. According to the claims, the stolen material includes corporate documents and sensitive personal records.

Conpet has not publicly confirmed the scale or contents of the alleged data theft. Authorities are still assessing whether customer, employee, or partner information was exposed during the breach.

Response and Ongoing Investigation

Following the incident, Conpet notified national cybersecurity authorities and law enforcement. The company also filed a criminal complaint as required under Romanian regulations. Technical teams continue to analyze how the attackers gained access and whether additional systems require remediation.

Recovery efforts focus on restoring business services while preserving evidence for forensic review. The company has not disclosed whether attackers deployed encryption across internal systems or demanded a ransom.

Impact on Critical Infrastructure

The Conpet ransomware attack highlights the persistent threat to energy sector organizations. While this incident did not disrupt oil transport, it demonstrates how attackers continue to probe the boundary between corporate IT and operational environments.

Separating business systems from industrial control systems helped limit the impact. However, the incident underscores the importance of strong network segmentation, monitoring, and incident response planning.

Broader Ransomware Trend

Ransomware groups increasingly target organizations that manage essential services. Energy, transportation, and utilities remain attractive targets due to their reliance on continuous operations and complex digital environments.

Even when attackers avoid operational disruption, data theft and public disclosure can still cause financial, regulatory, and reputational damage.

Conclusion

The Conpet ransomware attack shows how cybercriminals continue to pressure critical infrastructure operators through data theft and system disruption. Although oil transport operations remained unaffected, the incident reinforces the need for robust defenses across both business and industrial networks. As investigations continue, the energy sector faces renewed urgency to strengthen resilience against ransomware threats.