Delek US listed on Helix ransomware leak site

• Ransomware group: Helix
• Country: United States
• Sector: Energy & Utilities
• Announcement date: August 19, 2026

Helix claims to have stolen data from Delek US

The ransomware group known as Helix has listed the American energy company Delek US on its dedicated leak site. According to the announcement made by the threat actors, the group claims to possess internal data belonging to the organization. This listing marks a significant development in the ongoing tension between the cybercriminal group and the targeted entity.

On August 19, 2026, the Helix group officially announced the listing of Delek US on their platform. The group has indicated that they intend to release the stolen information in stages rather than all at once. The threat actor claims to have organized the stolen data into four distinct tiers based on different sensitivity levels, a method often used by cybercriminals to increase pressure on a target. While the specific details regarding the ransom demand remain unknown, the group's claim suggests a large-scale compromise involving a significant volume of files.

Details of the claimed data breach

The listing provided by the Helix group suggests that a vast amount of information has been compromised. Specifically, the threat actor claims to have access to 725,185 files. The leaked data is reportedly categorized by the attackers, ranging from what they describe as 'least sensitive' to 'restricted' information. Based on the information provided in the leak site announcement, the following types of data are claimed to be involved:

• Entra environment directories
• SharePoint library data

The inclusion of Entra environment directories is particularly noteworthy, as such data often contains critical information regarding identity and access management within a corporate infrastructure. The presence of SharePoint library data further suggests that internal documentation and collaborative files may be part of the breach.

About Delek US

Delek US is an American energy company that maintains a significant presence in the United States. The organization operates across several critical areas of the energy sector, including petroleum refining, logistics, and retail. The company specializes in the processing of crude oil and the distribution of various types of fuel, making it a key player in the energy and utilities sector.

Analysis and potential implications

This claim of a data leak may raise significant questions regarding the security of the Delek US corporate network and the effectiveness of its existing data protection processes. The potential exposure of Entra environment data is a serious concern, as it could increase the risk of secondary attacks. Specifically, such information can be used by threat actors to target internal user accounts and exploit existing authorization structures within the network.

Because Delek US is a United States-based entity, the organization may face various legal obligations following such an incident. Depending on the nature of the data and the specific circumstances, the company may be subject to data breach notification requirements mandated by relevant state laws and federal regulations. The impact of such a breach can extend beyond legal compliance, potentially affecting the organization's operational continuity and the trust held by its stakeholders.

Regarding the tactics used by the attackers, the staged release method employed by Helix may represent a double-extortion strategy. In double-extortion scenarios, attackers do not only encrypt data to disrupt operations but also steal sensitive information to threaten the victim with public disclosure. This method is designed to maximize the pressure on the organization to meet the attackers' demands. While information regarding the Helix group remains limited, their approach follows a pattern seen in modern ransomware operations.

For organizations operating in the energy and utilities sector, such incidents highlight the importance of robust cybersecurity frameworks. Defensive measures typically include implementing multi-factor authentication, maintaining rigorous access controls for cloud environments like Entra and SharePoint, and ensuring comprehensive monitoring of network activity to detect unauthorized data exfiltration. Maintaining a strong incident response plan is also vital for managing the operational and reputational consequences of a potential breach.