Eni Energy Listed by lapsus$ Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 1, 2026, the ransomware group lapsus$ listed Eni Energy on its leak site, stating that internal files had been taken during a ransomware operation. Public information about the scope of the incident remains limited, with no confirmed count of affected individuals or details on whether the files contained personal data. For people whose information may sit in corporate systems of this kind, the event raises the possibility that records held by a major energy operator could surface in unauthorized hands, even when the precise contents and reach of the exfiltration are still unknown.

Inside the incident

The only confirmed public detail is the listing itself, which attributes the action to lapsus$ and describes the taking of internal files. No timeline for the intrusion, no volume of data, and no confirmation of encryption or ransom demands have been released by the company or independent investigators. The number of people potentially affected is listed as unknown.

The group behind it: lapsus$

Lapsus$ is a ransomware and extortion group that has previously claimed operations against large technology, telecommunications and government-linked organizations. Its pattern typically involves gaining access to corporate networks, exfiltrating data, and then posting samples or lists on a public leak site to pressure victims. The group’s listings are presented as claims rather than independently verified events until corroborated by the target organization or law-enforcement statements.

Eni Energy and its sector

Eni Energy is an Italian multinational oil and gas company headquartered in Rome and founded in 1953. It operates across exploration, production, refining, electricity generation and chemicals in dozens of countries. Organizations of this scale routinely maintain extensive internal records on operations, partners, employees and regulatory compliance.

The information in question

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of file types or confirmation that personal data is present has been made public. Energy companies commonly store employee records, contractor details, operational logs and technical documents; whether any of these categories were among the claimed files remains unconfirmed.

The real-world impact

Exposure of internal operational files can create secondary risks for the organization, including competitive intelligence loss or follow-on targeting by other actors. If personal data of employees, contractors or customers is later shown to be included, affected individuals could face increased phishing, fraud or identity misuse. At present, the absence of confirmed personal-data categories means the direct risk to individuals cannot be quantified beyond the general possibility attached to any corporate network intrusion.

If your data was in this claimed breach

Monitor bank and benefits accounts for unusual activity and enable multi-factor authentication on any services that may hold related credentials. Request a copy of your data from Eni Energy if you are an employee or contractor. Readers can also run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.