United Lube Oil listed on RansomHouse leak site

• Ransomware group: RansomHouse
• Country: Saudi Arabia
• Sector: Manufacturing
• Announcement date: October 22, 2025

United Lube Oil targeted by RansomHouse

The manufacturing company United Lube Oil has been listed on the leak site operated by the ransomware group known as RansomHouse. The threat actor claims to have successfully executed a cyberattack against the organization and is currently engaging in extortion activities by alleging that it has compromised the entity's confidential data.

Details of the claimed attack

According to the announcement made on the RansomHouse leak site on October 22, 2025, the group claims that the organization was subjected to a cyberattack on September 10, 2025. The group is utilizing a double extortion tactic, a common method in modern ransomware campaigns where attackers not only encrypt a victim's systems but also steal sensitive information to pressure the organization into paying a ransom by threatening to leak the data publicly.

In such scenarios, ransomware groups often use leak sites to host stolen information to maximize pressure on the victim. These sites serve as a public gallery of compromised data, intended to damage the reputation of the target. The group's current activities involve using the stolen information as leverage to demand payment from the organization.

Data involved in the incident

The specific nature of the compromised data has not been disclosed by the threat actor. While the group has not provided details regarding the total volume of data or the specific file count, they have made certain files accessible to the public under the label of 'evidence packs'. The listing does not name any specific data types that have been stolen.

About United Lube Oil

United Lube Oil Company (UNILUBE) is an oil refinery and lubricant blending plant. The company operates in Jubail Industrial City, Saudi Arabia, and has been producing high-quality base oil since 2002.

Risk assessment and implications

This incident may pose significant risks to the organization's operational continuity and commercial reputation. Given that the RansomHouse group has been observed since 2021 focusing on data exfiltration and extortion, there is a persistent concern regarding the possibility of sensitive data being sold or exposed to third parties.

The potential consequences of such a breach are multifaceted. The organization may face legal obligations under the data protection regulations applicable in Saudi Arabia. Furthermore, depending on the nature of the leaked information, there may be a risk of employees or business partners being exposed to identity theft and targeted phishing attacks. Phishing attacks often follow data breaches, as criminals use the stolen information to craft highly convincing messages to deceive individuals within the supply chain or the organization itself.

For organizations operating in the manufacturing and industrial sectors, maintaining robust cybersecurity postures is essential to mitigate these risks. Common defensive steps include implementing strict access controls, maintaining regular offline backups, and conducting continuous monitoring of network traffic to detect unauthorized data exfiltration. Protecting the integrity of the supply chain and ensuring that business partners adhere to similar security standards can also help reduce the overall risk profile of the organization.