TotalEnergies Investigates Alleged Data Breach After Hackers Leak 184 Million Records Energy giant TotalEnergies is examining claims of a major data breach after a hacking group alleged it exfiltrated a database containing 184 million records and began publishing purported customer information on X (formerly Twitter). The company has not confirmed the breach, stating it is still assessing the validity of the claims. The incident surfaced when the hackers posted samples of the data online, though the full extent of the exposed information remains unclear. If verified, this could rank among the largest breaches of 2025, potentially exposing sensitive customer details. The attack follows a recent surge in high-profile cyber incidents, including a ransomware attack on the University of Hawaii Cancer Center in August 2025, which compromised research participant data, and Brightspeed’s investigation into a breach affecting 1 million customers. Meanwhile, Grubhub confirmed a separate data breach after hackers stole internal data and issued extortion demands. As organizations grapple with escalating cyber threats, this incident underscores the growing risks of large-scale data exposure in critical sectors. TotalEnergies has not yet disclosed further details on the investigation or potential impact.

In July 2024, TotalEnergies Clientes SAU, a subsidiary of the global energy corporation TotalEnergies, fell victim to a targeted cyberattack. The incident involved unauthorized access to one of its sales management computer systems, resulting in the exposure of sensitive personal data belonging to 210,715 customers. The compromised information included confidential details, though the exact nature of the data (e.g., financial records, identification documents) was not publicly specified.The company responded by collaborating with law enforcement agencies and the Spanish Data Protection Agency (AEPD) to investigate the breach, mitigate risks, and pursue legal action against the perpetrators. While no ransomware was reported, the attack raised concerns over customer privacy violations and potential downstream risks such as identity theft or fraud. TotalEnergies emphasized efforts to strengthen cybersecurity measures and notify affected individuals, though the long-term reputational and operational impacts remain under assessment.

Ransomware Operators Systematically Neutralize Backups Before Striking A growing trend in ransomware attacks reveals a calculated strategy: threat actors now prioritize disabling backup infrastructure before deploying encryption, ensuring victims have no recovery options. This tactic, documented by MITRE ATT&CK as T1490 (Inhibit System Recovery), is now standard procedure for major ransomware groups. According to Veeam’s 2024 Ransomware Trends Report, attackers targeted backup repositories in 96% of incidents, succeeding in 76% of cases. The method relies on a prolonged dwell period averaging 70+ days during which adversaries map networks, harvest domain admin credentials, and methodically dismantle recovery mechanisms. By the time the ransom note appears, backups are often already purged, retention policies altered, or immutable storage rendered ineffective. The destruction process is systematic: - Mapping backup repositories and retention policies. - Manipulating retention settings to trigger automatic deletion of prior backups. - Abusing time synchronization to bypass immutable locks. - Terminating backup services before encryption begins. Even security measures like immutable storage, quorum controls, and air-gapped vaults fail when attackers operate with legitimate admin credentials. For example, immutable storage protects data blocks but not the management plane attackers can simply shorten retention policies to hours, letting automated purges erase backups. Similarly, quorum controls are bypassed during maintenance windows or by compromising multiple privileged accounts. The result is a 22-day average recovery time (per Gartner), extending to 38 days for enterprises (Total Assure). Recovery efforts don’t begin with data restoration but with containment, forensic preservation, and validating clean restore points a process complicated by the need to rebuild identity infrastructure (Active Directory, domain controllers) first. Every credential active during the attack must be rotated, adding days or weeks before business systems can resume. Some organizations are adopting alternative recovery methods that don’t rely on backups. Solutions like Halcyon target three layers of the attack chain: 1. File resilience: Intercepting encryption in real time before files are written to disk. 2. Lateral movement prevention: Limiting the spread of encryption to additional systems. 3. Key capture: Extracting cryptographic keys at execution to enable direct decryption, bypassing the need for backups. The disconnect between preparedness and reality is stark: Halcyon’s survey of 100 security leaders found most organizations believed their backups were secure until they weren’t. With attackers now dedicating weeks to neutralizing recovery options, traditional defenses are proving insufficient.