Mack Energy Corporation, an oil and gas exploration company headquartered in Artesia, New Mexico, suffered a ransomware attack in July 2025 by the hacking group Cicada3301. The attackers claimed to have exfiltrated 3.1 terabytes of sensitive data, including personally identifiable information (PII) such as names and Social Security Numbers (SSNs) of at least 413 individuals in Texas, as disclosed to the Texas Attorney General in November 2025. The group threatened to publish the stolen data within 19–20 days and posted sample screenshots on their dark web portal on July 9, 2025.The breach exposed highly sensitive employee and customer data, posing severe risks of identity theft, financial fraud, and long-term reputational damage. Affected individuals were notified via U.S. Mail, with legal firms like Shamis & Gentile P.A. investigating potential class-action lawsuits for compensation due to the company’s failure to protect the data. The incident highlights critical vulnerabilities in Mack Energy’s cybersecurity infrastructure, with far-reaching consequences for both internal stakeholders and external customers.

On July 9, 2025, Mack Energy Corporation, an independent oil and gas company based in New Mexico, fell victim to a ransomware attack by the group Cicada3301. The attackers exfiltrated 3.1 terabytes of data, including personally identifiable information (PII) such as names and Social Security numbers (SSNs) of at least 413 individuals in Texas. The breach was disclosed to authorities on November 7, 2025, with notifications sent to affected consumers via U.S. Mail. The ransomware group threatened to publicly release the stolen data within 19–20 days, posting sample screenshots as proof. The exposure of SSNs poses severe risks of identity theft, while the scale of the attack—combined with the public extortion threat—heightens financial, reputational, and operational consequences for the company. The incident likely disrupted internal systems, required forensic investigations, and necessitated coordination with cybersecurity experts and law enforcement. Affected individuals face long-term risks, including fraud and financial exploitation, while the company may suffer regulatory penalties, legal liabilities, and erosion of stakeholder trust.