El Wastani Petroleum Company (WASCO) listed by payload ransomware group

• Ransomware group: payload
• Country: Libya
• Sector: Energy & Utilities
• Announcement date: April 8, 2026

Payload ransomware group claims data breach at El Wastani Petroleum Company

The threat actor known as payload has listed the Egyptian-based firm El Wastani Petroleum Company (WASCO) on its leak site. According to the announcement, the group claims to be in possession of a significant dataset allegedly obtained from the organization's networks.

Details of the claimed attack

The announcement made by the payload group refers to discovery and attack activities dated April 8, 2026. The threat actor claims to have published a 50 GB dataset that was allegedly extracted from the company's internal systems. This type of activity is often associated with double extortion tactics, where attackers not only encrypt an organization's data to disrupt operations but also threaten to leak sensitive information on public platforms to pressure the victim into paying a ransom.

While the group has publicized the existence of this data, the specific content of the leaked material has not been specified. The listing provides no information regarding the exact file types or the nature of the documents contained within the 50 GB volume.

Organization profile

El Wastani Petroleum Company (WASCO) is an Egyptian oil and gas company. The company focuses on the exploration, production, and processing of natural gas and condensate, primarily operating in the Nile Delta and North Sinai regions.

Risk assessment and industry implications

This incident may pose operational and commercial risks for El Wastani Petroleum Company (WASCO). As an entity operating in the energy sector, it is assessed that if the allegedly leaked data contains critical infrastructure information or trade secrets, corporate security could be compromised. The unauthorized access to such data may lead to reputational damage and potential legal proceedings for the organization.

Information regarding the payload group remains limited in the public domain. Beyond the immediate impact of the leak, secondary risks may include the use of leaked data in targeted phishing attacks or the compromise of supply chain security. In the energy sector, where infrastructure is vital, such breaches can have cascading effects on regional operations.

To defend against such threats, organizations typically implement multi-layered security strategies. Common defensive steps include maintaining robust backup systems, implementing strict access controls, and conducting regular network monitoring to detect unauthorized intrusions. Additionally, organizations often focus on employee training to mitigate the risk of phishing, which is a frequent entry point for ransomware actors. Given the potential for secondary risks like supply chain compromise, maintaining visibility into third-party connections is also a critical component of modern cybersecurity posture.