On February 4, 2026, an unauthorized party breached the corporate IT network of Conpet SA, Romania’s state-controlled national oil pipeline operator. Conpet manages approximately 4,000 kilometers of pipeline supplying domestic and imported crude oil, gasoline, and liquid ethane to refineries across the country. The company disclosed the incident the following day. The Qilin ransomware gang — a RaaS operation active since August 2022 under the original name “Agenda” — claimed responsibility on February 5 via its Tor data-leak site, publishing sample documents including financial records and passport scans as proof of access. The group asserted it had exfiltrated approximately 1TB of data.
Conpet issued a public statement confirming that its SCADA system and Telecommunications System were not affected, and that pipeline transport operations continued in normal parameters throughout the incident. The company notified DIICOT (Romania’s directorate for organized crime and terrorism) and filed a criminal complaint. It is cooperating with the Romanian National Cyber Security Directorate (DNSC) on the technical investigation.
Qilin has been one of the more active RaaS groups through 2025 and into 2026, reaching roughly 100 claimed victims in June 2025 alone. The group targets internet-exposed services for initial access and relies on credential harvesting for lateral movement. No ransom amount was disclosed by either party, and Conpet did not confirm the volume or classification of data accessed by investigators at the time of disclosure.
The incident is notable as the second major ransomware hit on a Romanian energy company within six weeks, following the December 26, 2025 Gentlemen ransomware attack on Oltenia Energy Complex. Neither incident resulted in confirmed OT or industrial control system compromise, but the concentration of ransomware targeting on Romanian energy operators in this period matches a broader regional trend documented in the Waterfall 2026 Threat Report and the Dragos 2026 Year in Review. The closest structural precedent in the RISI archive is the 2020 US natural gas compression facility ransomware incident, where a Ryuk infection spread via a corporate IT network to a SCADA polling server, causing a two-day operational shutdown — the scenario Conpet’s network segmentation appears to have prevented here.