Skip to content
brandefense.io
Request A Demo

Search Ransomware Intelligence

Jump to a group, country, industry or search victims.

#15 of 28 industriesWatch Energy and Utilities

Energy and Utilities: Who Is Hitting It.

As of Oct 19, 2026, 379 Energy and Utilities organisations have been listed as ransomware victims on leak sites, 1.2% of all confirmed victims (about 1 in 83). The most active group in this sector is Qilin.

Updated continuously · figures as of Oct 19, 2026
Confirmed victims
379
Share of all victims
1.2%
Rank
#15 of 28 sectors
Most active group
Qilin
Most hit country
United States

Victims Posted Per Month.

Confirmed ransomware victims in Energy and Utilities per month
MonthConfirmed victims
November 20253
December 20258
January 202615
February 202615
March 202623
April 202618
May 202615
June 202617
July 202626
August 202624
September 202621
October 2026 (month in progress)17

Most Active Groups Here

  1. Qilin4010.6% of all victims
  2. Clop328.4% of all victims
  3. The Gentlemen318.2% of all victims
  4. LockBit 3.0236.1% of all victims
  5. Akira164.2% of all victims

Most Hit Countries In This Industry

  1. USUnited States13435.4%
  2. DEGermany215.5%
  3. CACanada164.2%
  4. FRFrance133.4%
  5. GBUnited Kingdom133.4%

Latest Victims.

All 379 Energy and Utilities victims →
Latest confirmed ransomware leak-site victims in Energy and Utilities
VictimClaimed byCountryIndustryData claimedPosted
Pengurusan Aset Air Berhad
paab.my
QilinMYMalaysiaEnergy and UtilitiesNot stated
Luzco Ilumination
luzco.es
EmperadorESSpainEnergy and Utilities1.4 GB
ONEOK, Inc.
oneok.com
RedactUSUnited StatesEnergy and Utilities67.5 GB
lcww.com.eg
lcww.com.eg
LockBit 5.0EGEgyptEnergy and UtilitiesNot stated
Petroleum Telcom Communications
ptelcom.com
The GentlemenUSUnited StatesEnergy and UtilitiesNot stated
Comisión Municipal de Agua Potable y Alcantarillado de Victoria
comapavictoria.gob.mx
QilinMXMexicoEnergy and UtilitiesNot stated
Eversource Energy
eversource.com
RedactUSUnited StatesEnergy and Utilities3.8 TB
IGPL
igpetro.com
HyflockINIndiaEnergy and UtilitiesNot stated

Sector Briefings For Energy and Utilities, Every Week.

The Brandefense platform sends a weekly ransomware brief for your sector and region: new groups, new victims among your peers and suppliers.

Request A Demo

Figures as of Oct 19, 2026. Confirmed leak-site claims collected by Brandefense technologies and validated by Brandefense analysts.

Listed on a leak site means a ransomware group has claimed the company; it is not a confirmed breach. To request a correction or removal, contact Brandefense.