Mellitah Oil & Gas / Enigas Ly (Eni Electricity, Oil & Gas) Listed by ransomhub Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

For anyone whose personal or professional details may sit inside the systems of a major energy operator, a ransomware listing is not an abstract cybersecurity story. It raises immediate questions about whether internal records, correspondence, or operational documents that touch staff, contractors, or partners have left the organisation’s control. Public detail on this incident remains limited, yet the claim alone is enough to warrant careful attention from those who work with or rely on the company.

On 29 April 2024, the ransomware group known as ransomhub listed Mellitah Oil & Gas / Enigas Ly (Eni Electricity, Oil & Gas) on its leak site. The group claimed to have exfiltrated internal files in a ransomware attack and advertised a data size of 1 TB. The listing noted 160 visits and stated that the material had not been published. The number of people affected is unknown, and no further independent confirmation of the claims has been provided in the available record.

What happened

According to the public listing attributed to ransomhub, Mellitah Oil & Gas / Enigas Ly was the subject of a ransomware attack in which internal files were taken. The reported date of the listing is 29 April 2024. The group’s own summary stated a data volume of 1 TB, recorded 160 visits to the listing page, and indicated that the material had not been published at the time of the report. No technical details of the intrusion method, the precise systems involved, or any ransom demand have been disclosed in the available facts. The number of individuals whose information may have been among the files remains unknown. Because the listing originates from the threat actor, it must be treated as an unverified claim unless and until independently confirmed.

Inside ransomhub

Ransomhub is a ransomware operation that has been publicly documented as following a double-extortion model common among modern ransomware groups. In this model, operators encrypt systems and also claim to steal data, then threaten to publish or sell the material if a ransom is not paid. The group maintains a leak site where it lists claimed victims, often displaying file counts, data volumes, or sample screenshots to increase pressure. Ransomhub has been observed targeting organisations across multiple sectors and geographies; its listings typically present the victim’s name, a claimed data size, and a status indicating whether material has been released. Public reporting has associated the group with Ransomware-as-a-Service practices, in which affiliates conduct attacks under a shared brand and infrastructure. None of these general characteristics prove the specific claims made about any single victim; they simply describe how the group is known to operate. In this case, the only statements attributed to ransomhub are those appearing on its listing: that internal files were allegedly exfiltrated, that the volume was approximately 1 TB, and that the data had not yet been published.

About Mellitah Oil & Gas / Enigas Ly (Eni Electricity, Oil & Gas)

Mellitah Oil & Gas is a significant energy enterprise operating in Libya’s oil and gas sector, with ties to international partners including Eni. Organisations of this type manage large-scale upstream and midstream operations, joint-venture agreements, contractor relationships, and the associated corporate and operational systems. They typically hold personnel records, commercial contracts, technical documentation, financial data, and correspondence with government and industry partners. Because energy infrastructure is strategically important and often involves sensitive commercial and safety-related information, any unauthorised access to internal systems carries consequences that extend beyond ordinary corporate data loss. A breach claim against such an entity therefore attracts attention from employees, contractors, suppliers, and regulators who must assess whether their own information or operational continuity could be affected.

What data was at risk

The available facts state only that “internal files” were claimed to have been exfiltrated in a ransomware attack, with a reported data size of 1 TB. No inventory of specific file types, databases, or personal-data categories has been disclosed. Organisations in the oil and gas sector commonly store employee and contractor personal details, payroll and human-resources records, commercial contracts, engineering drawings, operational logs, and internal communications. Whether any of those categories were among the claimed 1 TB remains unconfirmed. The listing itself indicated that the material had not been published. Until more precise information is released by the organisation or verified by independent investigators, the exact contents of the claimed data set cannot be stated as fact.

The real-world impact

For individuals, the practical risk depends on whether personal identifiers, contact details, financial information, or employment records were among the internal files. If such data were present and later circulated, affected people could face phishing, identity misuse, or unwanted contact. For the organisation, the consequences of a claimed ransomware incident typically include operational disruption, costs of investigation and recovery, potential regulatory scrutiny, and damage to commercial relationships. Because the listing remains an unconfirmed claim and the data were reported as unpublished, the immediate public exposure of any specific records has not been established. Even so, the mere assertion of a 1 TB exfiltration creates uncertainty that staff, partners, and counterparties must manage carefully until clearer information emerges.

If your data was in this claimed breach

If you have a current or past relationship with Mellitah Oil & Gas / Enigas Ly—as an employee, contractor, supplier, or partner—treat the claim seriously while recognising that details remain limited. Monitor financial and email accounts for unusual activity, enable multi-factor authentication wherever available, and be alert to unexpected messages that reference the company or request sensitive information. Consider changing passwords on any accounts that reused credentials associated with work systems. You can also run a free exposure scan of your email address to check whether your information has already appeared in known breach data sets. Keep records of any suspicious contacts and follow official guidance issued by the organisation or relevant authorities as it becomes available. Public information on this incident is still sparse; remaining calm, verifying sources, and taking basic protective steps is the most useful response while further facts are established.

AICompiled with AI assistance from public sources and published under our editorial standards.