DESFA

In August 2022, **DESFA**, Greece’s largest natural gas distributor, confirmed a **cyberattack** resulting in a **limited-scope data breach** and an **IT system outage**. The attack was executed by the **Ragnar Locker ransomware group**, a well-known threat actor with a history of high-profile breaches. While DESFA’s IT team managed to **thwart deeper infiltration**, hackers still **accessed and potentially leaked files and data**, confirming a network intrusion. The incident disrupted operations, though the full extent of the data exposure remains unclear. The involvement of **ransomware** (Ragnar Locker) suggests the attackers likely **demanded a ransom**, though DESFA did not publicly confirm payment or further operational disruptions beyond the initial breach. The attack highlights vulnerabilities in critical infrastructure, raising concerns about **energy sector security** and the broader implications of cyber threats on national utilities. The leak of internal data—even if limited—poses risks to **corporate confidentiality, operational integrity, and potential regulatory repercussions**.

Source: https://www.secureblink.com/cyber-security-news/new-donut-leaks-group-is-involved-in-a-series-of-ransomware-attacks-1

TPRM report: https://www.rankiteo.com/company/c&m-engineering-s-a-

"id": "c&m416092125",
"linkid": "c&m-engineering-s-a-",
"type": "Ransomware",
"date": "8/2022",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization’s existence"

{'affected_entities': [{'industry': 'energy (natural gas distribution)',
                        'location': 'Greece',
                        'name': 'DESFA (Natural Gas Distribution Network '
                                'Operator)',
                        'type': 'government-owned enterprise'}],
 'data_breach': {'data_exfiltration': True},
 'date_publicly_disclosed': '2022-08',
 'description': "Greece's largest natural gas distributor, DESFA, confirmed a "
                'limited-scope data breach and IT system outage following a '
                'cyberattack in August 2022. Hackers attempted to infiltrate '
                "its network but were thwarted by the IT team's quick "
                'response. Some files and data were accessed and possibly '
                'leaked, indicating a network intrusion. The attack was linked '
                'to the Ragnar Locker ransomware operation, which leaked data '
                'on a Friday.',
 'impact': {'data_compromised': True,
            'downtime': True,
            'operational_impact': True,
            'systems_affected': True},
 'ransomware': {'data_exfiltration': True,
                'ransomware_strain': 'Ragnar Locker'},
 'response': {'communication_strategy': ['public statement confirming limited '
                                         'breach'],
              'containment_measures': ['quick response by IT team'],
              'incident_response_plan_activated': True},
 'threat_actor': 'Ragnar Locker',
 'title': 'DESFA Limited Scope Data Breach and IT System Outage (August 2022)',
 'type': ['data breach', 'IT system outage', 'ransomware attack']}