On March 26, 2025, Lukoil, one of Russia’s largest oil companies, was hit by a large-scale cyberattack that led to a complete shutdown of its internal systems. Employees were unable to access their work accounts, with their computers displaying unusual error messages. The company instructed its staff not to log into their accounts to avoid further data breaches. As a result, both client systems and internal databases remained inaccessible. The company has not provided a clear timeline for restoring its systems, and there is still no official estimate on when operations will resume.
The cyberattack affected Lukoil’s offices in cities such as Tyumen, Kogalym, and Perm, with employees across these regions reporting issues accessing their corporate accounts.
In addition to this, disruptions were also observed at Lukoil’s fuel stations, where customers had difficulty paying with bank cards. The system failures caused a partial halt in fuel distribution, which added to the growing concern over the incident’s impact. Furthermore, Russia’s Fast Payment System (SBP) experienced an outage, with more than 1,500 complaints about the service disruption.
This simultaneous failure of multiple systems indicates the scale of the attack and its wide-ranging effects.
Lukoil has been the target of cyberattacks before, with a similar incident occurring in 2024, which took three days to resolve. Management has since instructed employees to shut down their work computers to prevent further data leaks and mitigate the attack’s damage. While the company has not released specific details regarding the attackers, it has emphasized that the cyberattack did not originate from within its own systems. The company’s management team is still in the process of assessing the impact and restoring normal operations.
In addition to this cyberattack, Lukoil’s facilities have been subjected to other forms of disruption. Earlier in March 2025, a fire broke out at a Lukoil refinery in Volgograd, allegedly caused by a drone attack. Local residents reported explosions in the area, although the extent of the damage remains unclear. These incidents, including both cyberattacks and physical threats, reflect the growing vulnerability of Russia’s critical infrastructure, especially in the oil sector. Lukoil, a key player in Russia’s energy industry, is under increasing pressure as it faces these ongoing challenges.
Reference:
