Ransomware Attacks on Energy Companies Surged 80% Last Year

The numbers are staggering. According to a 2025 Trustwave report, ransomware attacks targeting energy and utility companies increased 80% year over year, with 84% of incidents beginning with a phishing email and 96% exploiting remote-access services.

What Happened in the Past 12 Months

• Halliburton suffered a RansomHub attack that caused $35 million in losses after the company was forced to shut down IT systems and disconnect customers (BleepingComputer, 2025).
• A Southeast Asian energy provider had its control systems disabled for 18 days by the NightSpire group, which demanded an $8 million ransom.
• Pakistan Petroleum Limited detected a ransomware intrusion affecting its IT infrastructure in August 2025.

The energy sector is now among the most targeted industries for ransomware globally. And the attacks aren’t just about locking data. They’re increasingly targeting operational technology — which means production shutdowns, safety risks, and cascading impacts that move past the security org and onto the front page.

What a Modern Defense Looks Like

Sphinx delivers intelligence-driven security solutions designed for high-consequence, no-fail environments. Our Evolved Security Playbook helps energy companies discover their vulnerabilities, neutralize active threats, and adapt to the evolving threat landscape:

• RECON — multi-domain assessment that maps your real attack surface, including the IT/OT seam and your remote-access exposure.
• RedShift — adversary emulation that replicates the exact TTPs being used by RansomHub, NightSpire, and their peers right now.
• Helix — managed detect / protect / respond that catches the pre-positioning before it becomes encryption.