McDermott International, Ltd Listed by alphv Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to single out large industrial and engineering firms, treating stolen internal files as both leverage and a commodity. In that climate, the appearance of a major energy-sector contractor on a criminal leak site is a signal worth examining carefully, even when public detail remains thin.

On April 29, 2023, McDermott International, Ltd was listed by the alphv ransomware group. The listing asserts that internal files were exfiltrated in a ransomware attack. The number of people affected is unknown, and further technical specifics have not been publicly confirmed. For employees, partners, and others whose information may sit inside corporate systems, the claim alone is reason to understand what is known and what remains unverified.

Inside the incident

Public reporting on this incident is limited to the alphv listing itself and the accompanying description that internal files were taken during a ransomware attack. No confirmed timeline of initial access, no disclosed method of intrusion, and no verified volume of data have been released in the available record. The number of individuals potentially affected is unknown. What is stated is that the group claims to have exfiltrated internal files belonging to McDermott International, Ltd and listed the organisation on its leak site on or around April 29, 2023. Beyond that claim, operational details remain undisclosed.

Inside alphv

Alphv, also widely known in security reporting as BlackCat, is a ransomware operation that has functioned as a Ransomware-as-a-Service enterprise. Affiliates gain access to victim networks, deploy the group's encryptor, and exfiltrate data before encryption in a double-extortion model. The group has historically used a leak site to pressure organisations by threatening or carrying out publication of stolen material if demands are not met. Its tooling has been noted for cross-platform capability and for relatively sophisticated negotiation and pressure tactics. These patterns are drawn from extensive public documentation of the group's broader activity; they do not constitute independent confirmation of every detail of any single listing. In this case, the sole specific assertion tied to McDermott is the group's own claim that internal files were exfiltrated and that the company appeared on the leak site.

Who is McDermott International, Ltd?

McDermott International, Ltd is a global provider of engineering and construction solutions to the energy industry. It operates in more than 54 countries and employs more than 40,000 people, supported by a diversified fleet of specialty marine construction vessels and fabrication facilities worldwide. Incorporated in Bermuda and headquartered in the Energy Corridor area of Houston, Texas, the company sits at the intersection of large-scale energy infrastructure, complex supply chains, and multinational project delivery. Organisations of this type typically maintain extensive repositories of project documentation, employee and contractor records, commercial contracts, engineering designs, and operational data. A breach affecting such an entity therefore carries potential consequences not only for the firm itself but for the wider network of workers, partners, and clients whose information may reside in those systems.

What was likely exposed

The available facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of file categories, record counts, or named data elements has been disclosed. Exact contents therefore remain unconfirmed. Companies in engineering and energy construction commonly hold personnel files, identity and contact details, payroll and benefits information, vendor and subcontractor records, project plans, technical drawings, and commercial correspondence. Any of those categories could theoretically be present among internal files, yet it would be inaccurate to treat them as verified exposures in this incident. Until more specific inventories are published by the organisation or by independent investigators, the public record supports only the general claim of internal-file exfiltration.

What's at stake

For individuals, the primary risks are secondary misuse of personal or professional data if it was among the taken files—phishing that references real internal details, identity fraud, or targeted social engineering against employees and contractors. For the organisation, stakes include operational disruption, potential regulatory and contractual obligations, reputational harm, and the cost of investigation and remediation. Because the scale and precise contents are unknown, the practical impact cannot yet be quantified; the prudent stance is to treat the claim seriously while recognising that many details remain unverified.

Were you affected?

If you are a current or former employee, contractor, or partner of McDermott International, Ltd, consider the following practical steps:

• Monitor financial and identity accounts for unusual activity and enable stronger authentication where available.
• Treat unexpected messages that reference internal projects or colleagues with caution; verify through known official channels.
• Review any breach notifications you receive directly from the company and follow their guidance on credit monitoring or other support if offered.
• Change passwords on work-related and personal accounts that may have shared credentials, and avoid reusing passwords across services.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. Public detail on this incident remains limited; staying alert to official updates from the organisation is the most reliable way to learn whether your specific records were involved.

AICompiled with AI assistance from public sources and published under our editorial standards.