Romania’s Largest Coal Energy Provider Hit by Ransomware Attack Romania’s largest coal-based energy producer, Oltenia Energy Complex (Complexul Energetic Oltenia), suffered a ransomware attack on December 26, disrupting its IT infrastructure. The state-owned company, which employs 19,000 people and supplies 30% of Romania’s electricity, reported that the incident encrypted files and temporarily disabled critical systems, including ERP platforms, document management tools, email services, and its website. While the attack partially affected operations, the company confirmed that the National Energy System remained stable. IT teams immediately began restoring systems from backups, though the full impact—including potential data theft—is still under assessment. Authorities, including the National Cyber Security Directorate, Ministry of Energy, and DIICOT (Romania’s cybercrime investigation unit), were notified, and a criminal complaint was filed. The attack has been attributed to the Gentlemen ransomware group, which emerged in August 2024 and is known for exploiting compromised credentials and exposed services. The gang typically leaves README-GENTLEMEN.txt ransom notes and appends the .7mtzhh extension to encrypted files. Though the group has listed nearly 40 victims on its leak site, Oltenia Energy Complex has not yet appeared, suggesting possible ransom negotiations. This incident follows another recent attack on Romanian Waters (Administrația Națională Apele Române), the country’s water management authority, which disrupted 1,000 systems across 10 regional offices earlier in December—though core operations remained unaffected. Romania has faced a surge in ransomware attacks, including a 2023 breach of Electrica Group by the Lynx gang and a February 2024 Backmydata ransomware attack that forced over 100 hospitals offline.