Romania’s Largest Coal Energy Provider Hit by Ransomware Attack Romania’s largest coal-based energy producer, Oltenia Energy Complex (Complexul Energetic Oltenia), suffered a ransomware attack on December 26, disrupting its IT infrastructure. The state-owned company, which employs 19,000 people and supplies 30% of Romania’s electricity, reported that the incident encrypted files and temporarily disabled critical systems, including ERP platforms, document management tools, email services, and its website. While the attack partially affected operations, the company confirmed that the National Energy System remained stable. IT teams immediately began restoring systems from backups, though the full impact—including potential data theft—is still under assessment. Authorities, including the National Cyber Security Directorate, Ministry of Energy, and DIICOT (Romania’s cybercrime investigation unit), were notified, and a criminal complaint was filed. The attack has been attributed to the Gentlemen ransomware group, which emerged in August 2024 and is known for exploiting compromised credentials and exposed services. The gang typically leaves README-GENTLEMEN.txt ransom notes and appends the .7mtzhh extension to encrypted files. Though the group has listed nearly 40 victims on its leak site, Oltenia Energy Complex has not yet appeared, suggesting possible ransom negotiations. This incident follows another recent attack on Romanian Waters (Administrația Națională Apele Române), the country’s water management authority, which disrupted 1,000 systems across 10 regional offices earlier in December—though core operations remained unaffected. Romania has faced a surge in ransomware attacks, including a 2023 breach of Electrica Group by the Lynx gang and a February 2024 Backmydata ransomware attack that forced over 100 hospitals offline.

Shinhan Card Reports Data Breach Affecting 190,000 Merchant Representatives Shinhan Card disclosed a data breach involving approximately 192,088 records of merchant representatives, marking the latest in a series of recent leaks affecting major South Korean firms, including Coupang, KT, SK Telecom, and Lotte Card. The incident, reported to the Personal Information Protection Commission (PIPC) on Tuesday, was attributed to internal employee misconduct related to new card solicitation rather than external hacking. The exposed data included: - 181,585 records containing only mobile phone numbers - 8,120 records with phone numbers and names - 2,310 records with phone numbers, names, birth years, and gender - 73 records with phone numbers, names, and full dates of birth Shinhan Card confirmed that no highly sensitive information—such as resident registration numbers, card details, or bank accounts—was compromised. The breach was limited to merchant representatives, with no impact on individual cardholders. The company stated that the leak stemmed from isolated employee actions and posed no further dissemination risk. The case came to light after a whistleblower submitted evidence to the PIPC, prompting an investigation. Shinhan Card began reviewing the allegations on November 13, verifying the breach through internal records. Following the findings, the company issued a public apology, notified affected merchants, and launched a webpage for individuals to check their exposure. While Shinhan Card has taken measures equivalent to those for a data breach, further review is needed to classify the incident officially. The company pledged to strengthen protections to prevent future occurrences. Security Investment Trends Lag Despite Rising Breaches A recent survey by market tracker Leaders Index revealed that while major South Korean firms increased IT spending by 31.2% (from 16.5 trillion won in 2022 to 21.6 trillion won in 2024), information security investment grew only marginally in proportion—from 5.8% to 5.9% of total IT budgets. Security staffing saw a similar trend, with dedicated personnel rising 22.3% but remaining at just 6.7% of IT workforce share. Analysts noted that despite absolute increases, security priorities continue to trail broader technology spending.

Over the weekend, multiple Romanian government websites, including those of the Ministry of Foreign Affairs and the Constitutional Court, were subjected to distributed denial-of-service attacks orchestrated by the pro-Russian hacktivist group NoName057(16). The targeted sites experienced a sustained flood of traffic that rendered them inaccessible to legitimate users, disrupting access to official election information and public services during the crucial rerun of Romania's presidential election. The election rerun itself had been prompted by the nullification of the initial vote after evidence of Russian interference emerged. Despite the severity of the timing and the potential for undermining public trust in the electoral process, no data breach or information theft occurred. All impacted websites were swiftly restored to normal operations by the Romanian National Directorate for Cyber Security, minimizing long-term operational disruption. However, the incident caused temporary service outages, prevented citizens and international observers from obtaining timely updates, and highlighted the vulnerability of state infrastructure to geopolitically motivated cyber attacks. The example underscores the need for robust DDoS mitigation strategies to safeguard democratic processes and maintain continuity of critical online services. The rapid recovery also demonstrated the effectiveness of coordinated incident response efforts and the importance of continuous monitoring to detect and thwart DDoS threats before they can inflict more widespread disruptions.