Vitality sector contractor ENGlobal Company has confirmed that non-public data was compromised throughout a November 2024 ransomware assault.
The incident occurred on November 25 and resulted in ENGlobal taking sure techniques offline as a containment measure, leaving entry to solely important enterprise operations out there.
In early December, the corporate knowledgeable the US Securities and Alternate Fee (SEC) that sure knowledge on its techniques had been encrypted through the assault, however made no point out of any knowledge theft.
In a brand new regulatory submitting with the SEC, ENGlobal confirmed that the attackers compromised private data saved on its techniques, with out detailing the scope of the data breach.
“The cybersecurity incident concerned the menace actor’s entry to a portion of the corporate’s IT system that contained delicate private data. The corporate intends to offer notifications to affected and doubtlessly affected events and relevant regulatory businesses as required by federal and state legislation,” ENGlobal mentioned.
The corporate additionally instructed the SEC that it has absolutely restored its techniques, that its operations and company capabilities have returned to regular, and that the menace actor behind the assault has been evicted from the community.
“The cybersecurity incident restricted the corporate’s means to entry parts of its enterprise purposes that supported features of the corporate’s operations and company capabilities, together with monetary and working reporting techniques for about six weeks,” ENGlobal mentioned.
The corporate famous that the incident has not had and isn’t anticipated to have a fabric affect on its operation, together with its monetary situation and outcomes of operations.
ENGlobal has not shared data on the menace actor behind the assault and information.killnetswitch has not seen any recognized ransomware group claiming duty for the incident.
