On December 26, 2025, Oltenia Energy Complex (Complexul Energetic Oltenia) — Romania’s largest coal-based electricity producer, with approximately 19,000 employees — detected a ransomware attack that encrypted files across its corporate IT infrastructure. The Gentlemen ransomware group, a RaaS operation that emerged in August 2025, claimed responsibility. Encrypted files received the extension .7mtzhh; ransom notes appeared as README-GENTLEMEN.txt containing contact instructions. Affected systems included ERP software, document management applications, the company email service, and its public website.
Power generation at Oltenia’s thermal plants continued without interruption throughout the incident. The company stated that “the national energy system’s operation was not jeopardized,” and electricity supply to Romania’s grid — of which Oltenia provides approximately 30% through coal-fired capacity — remained stable. IT teams began rebuilding affected systems on new infrastructure using existing backups. Oltenia reported the incident to Romania’s National Directorate of Cyber Security (DNSC), the Ministry of Energy, and filed a criminal complaint with DIICOT, the directorate for investigating organized crime and terrorism.
The timing is consistent with a pattern Trend Micro documented in its Gentlemen analysis: the group targets organizations over holiday periods when IT staffing is reduced, and deploys via compromised internet-facing services using stolen credentials. Gentlemen uses SystemBC, a proxy malware that routes C2 traffic through a botnet of compromised hosts, to reduce the likelihood of direct attribution through static infrastructure. The group had listed approximately 48 victims by the time of the Oltenia incident, with activity concentrated in Europe and North America.
No OT systems, industrial control equipment, or generation management infrastructure were identified as compromised. The attack surface was limited to the administrative IT layer, and the company’s statement explicitly separated operational continuity from the IT disruption. This pattern — IT encryption with operational isolation either by design or by luck — mirrors the 2021 Colonial Pipeline incident, where DarkSide’s ransomware hit billing and IT systems and the company proactively shut down the pipeline as a precaution rather than because OT was directly affected. In Oltenia’s case, no precautionary OT shutdown was reported.