Romania’s Oltenia Energy Complex suffers major ransomware attack

A ransomware attack struck Romania’s Oltenia Energy Complex on 26 December 2025, disrupting its IT systems and encrypting documents, including ERP, email, and the company website. The attack, identified as a ransomware type called “Gentlemen”, partially affected operations but the company stated that the national energy system remained safe. IT teams began restoring services from backups on new infrastructure, while the scope of the incident and any data leak were under investigation.

The firm filed a criminal complaint with DIICOT (Directorate for Investigating Organized Crime and Terrorism). According to the National Cyber Security Directorate (DNSC), the incident affected around 1,000 computer systems across the central organisation and 10 of its 11 regional offices, with authorities noting that operational technology for water infrastructure was not impacted. The Gentlemen ransomware group has not yet added Oltenia to its Tor data leak site, a sign that negotiations or further action may still be ongoing.