Halliburton Confirms Data Breach Following August Cyberattack

Halliburton, a major player in the global oilfield services industry, has confirmed that a recent cyberattack resulted in the unauthorized access and exfiltration of company data. The breach, which was first detected on August 21, 2024, has now been officially acknowledged in the company's latest SEC filing as a significant cybersecurity incident.

Halliburton still assessing the impact

The cyberattack was first detected on August 21, 2024, when Halliburton discovered that an unauthorized third party had infiltrated its systems. The company immediately activated its cybersecurity response plan, which included taking critical systems offline to contain the breach and engaging external cybersecurity experts, including Mandiant, to assist with the investigation and remediation efforts. Law enforcement agencies were also notified as part of the comprehensive response strategy.

Despite these rapid actions, Halliburton has now confirmed that the attackers managed to access and exfiltrate sensitive information from its systems. The specific details of the compromised data are still under evaluation, but the incident has already caused operational disruptions, including the inability of customers to generate invoices or purchase orders due to affected systems being down.

Headquartered in Houston, Texas, Halliburton is one of the largest oilfield services companies globally, employing over 40,000 people. The company provides a wide range of services to the oil and gas industry, including well construction, drilling, and hydraulic fracturing. The interconnected nature of these services with its customers means that the breach could have broader implications across the industry.

While Halliburton continues to deliver its products and services, the cyberattack has caused significant operational disruptions, particularly in business applications crucial for corporate functions. Halliburton stated that, despite these challenges, it does not currently expect the breach to impact its financial condition or results of operations. However, the company remains cautious, acknowledging the potential for ongoing risks, including litigation, regulatory scrutiny, and customer behavior changes as more details about the data exfiltration emerge.

RansomHub behind the attack

The latest 8-K Form filing does not attribute the cybersecurity incident to a specific threat group, but a previous BleepingComputer report has pointed the finger to the RansomHub ransomware gang. RansomHub is a relatively new but highly active ransomware operation that emerged in February 2024, known for its double-extortion tactics where it steals data before encrypting files and then uses the threat of data leaks to extort victims.

Halliburton’s response reportedly included taking systems offline and providing customers with technical indicators of compromise (IOCs) to help them detect similar activity on their networks. However, some Halliburton customers expressed frustration over the lack of detailed communication from the company, and some decided to disconnect from Halliburton’s systems as a precaution.

As Halliburton continues its investigation with the assistance of law enforcement and cybersecurity professionals, companies and stakeholders are advised to remain vigilant, enhance their security measures, and monitor for unusual activity.