The ALPHV/BlackCat ransomware gang claimed responsibility for stealing over 150 GB of sensitive data from Creos Luxembourg S.A., a critical infrastructure company managing natural gas pipelines and electrical networks in Luxembourg. The breach involved 180,000 files, including contracts, agreements, passports, bills, and emails, exposing highly confidential operational and personal data.While Encevo (Creos’ parent company) confirmed the incident, it stated that electricity and gas supply remained unaffected, and emergency breakdown services continued uninterrupted. However, the theft of proprietary contracts, employee/personal passports, and internal communications poses severe risks—potentially enabling future targeted attacks, fraud, or espionage. The incident is under investigation, with updates being shared via the company’s website.Given Creos’ role in national energy infrastructure, the breach—though not disrupting services—compromises critical operational integrity and could have cascading effects if exploited further. The involvement of a high-profile ransomware group (BlackCat/ALPHV) amplifies concerns over data extortion, regulatory penalties, and long-term reputational damage.

Creos Luxembourg S.A., a natural gas pipeline and electricity network operator in the central European country was targeted by the ALPHV ransomware gang, aka BlackCat. The attack affected the customer portals of Encevo and Creos becoming unavailable and the attackers exfiltrated “a certain amount of data” from the accessed systems. All the customers were recommended to reset their online account credentials, which they used for interacting with Encevo and Creos services. The ransomware group added Creos to its extortion site, threatening to publish 180,000 stolen files totaling 150 GB in size, including contracts, agreements, passports, bills, and emails.