On 30 April, the hacker group RansomHub announced that the Mellitah Oil & Gas Company had been hacked and 1 TB of confidential data was stolen. The hackers demanded the payment of a USD 50 million ‘ransom’ by 4 May. If it was not paid, the data would be published step by step on the Internet. They said certain data would be released to journalists while personal data would be used for criminal purposes. They added that hundreds of vulnerabilities had been detected in Mellitah’s IT system – these would be sold to other groups for renewed attacks. Some data sets were published immediately to back up the threat.
On 2 May, an Eni spokesperson confirmed that a cyber attack had taken place on the Mellitah Oil & Gas Company – Eni has a 50% stake in the company (the NOC has the other 50%). The spokesperson said that a step-by-step restoration of the compromised IT system is currently underway, stressing that the operational activities of Mellitah were not affected by the attack. On 3 May, RansomHub removed the stolen data from its website.