Russian Lukoil Hit by Major Cyberattack, Disrupting Operations Nationwide

Russian oil giant Lukoil experienced a large-scale cyberattack on March 26, resulting in a complete shutdown of its internal systems and disruptions across several regions, including corporate offices and gas stations.

According to reports from Telegram channels Baza and Ateo, employees across Lukoil’s offices in cities such as Tyumen, Kogalym, and Perm were unable to access their corporate accounts on Wednesday morning.

Staff were reportedly shown unusual error messages on their computers, suggesting a potential breach. Internal instructions were issued advising workers not to log into their accounts in order to prevent data leaks.

The company’s headquarters and regional branches remain affected. Access to client systems and internal databases is currently restricted. Lukoil’s management has instructed employees via SMS to shut down all work computers.

Disruptions have extended to the company’s fuel stations, where customers have reported being unable to pay with bank cards. Reports indicate a partial halt in fuel distribution due to system failures.

Additionally, Russia’s Fast Payment System (SBP) appears to have suffered a simultaneous outage. Downdetector, a platform that monitors service disruptions, registered over 1,500 complaints about SBP within one hour.

There is no official estimate on when the systems will be restored. According to reports, a similar incident last year took around three days to recover from.

Lukoil is the second-largest oil producer in Russia and a key player in the country’s energy sector.

Earlier on March 15, a fire broke out near the Sarepta railway station in Volgograd following reports of a drone attack. Russian Telegram channels suggested the nearby Lukoil oil refinery may have been the intended target. While local residents reported explosions across the city, the extent of the damage remains unconfirmed.