Qilin Ransomware Gang Steals Sensitive Data from Romania's Oil Pipeline Operator Conpet

Romania's state-owned oil pipeline operator Conpet S.A. has confirmed that threat actors from the Qilin ransomware gang successfully exfiltrated sensitive company data during a recent cyberattack. The breach, disclosed in an official update, compromised approximately 1TB of documents containing confidential financial records, passport scans, and personal identification data dating as recently as November 2025.

The attack targeted Conpet's corporate IT infrastructure but did not disrupt pipeline operations transporting crude oil and gas across Romania's 3,800km network. The company is collaborating with the Romanian National Cyber Security Directorate (DNSC) on the ongoing investigation, though the full scope of stolen data remains undetermined. Qilin substantiated their claims by leaking 16 sample documents including bank account numbers, personal IDs, and addresses.

Critical Infrastructure Vulnerability

This incident highlights persistent security challenges facing energy sector operators. While operational technology systems remained functional, the corporate network breach enabled significant data theft. Critical infrastructure entities like Conpet—designated as strategic national assets under Romania's Ministry of Energy—represent high-value targets due to the sensitive data they manage. The DNSC's involvement underscores the national security implications of such breaches.

Security researchers note that ransomware groups increasingly prioritize data exfiltration over operational disruption in critical infrastructure attacks. As one industrial control system specialist observed: 'Attackers recognize that stealing sensitive data provides long-term monetization opportunities through extortion and dark web sales, while causing physical disruptions attracts disproportionate law enforcement attention.'

Fraud Prevention Measures

Conpet has warned that stolen data could be used for fraudulent activities. Individuals potentially affected should implement these protections:

• Verify unsolicited communications: Scammers may impersonate Conpet staff requesting urgent actions. Always validate requests through official channels like Conpet's verified contact page before responding.
• Monitor financial accounts: Regularly review bank statements and credit reports for unauthorized transactions. Enable transaction alerts where available.
• Implement multi-factor authentication: Add secondary verification to all financial and email accounts, particularly for services linked to personal information.
• Report phishing attempts: Forward suspicious communications to DNSC's incident reporting portal at dnsc.ro for analysis.

Organizational Defense Strategies

For companies handling sensitive data, especially in critical infrastructure:

• Segment corporate and operational networks: Isolate IT systems handling sensitive data from industrial control systems to limit breach impact.
• Conduct regular data audits: Identify and encrypt high-value data stores containing personal or financial information.
• Deploy endpoint detection: Use advanced threat monitoring tools that identify abnormal data exfiltration patterns.
• Validate backup integrity: Ensure offline backups are regularly tested against ransomware encryption methods.

Conpet continues to investigate with DNSC while urging vigilance. The company maintains that pipeline operations remain secure, though the data breach serves as a stark reminder of evolving digital threats to essential services. Security teams should prioritize protecting data assets with equal rigor as operational systems.