Cyber-Attack Timeline: Halliburton

FAQs on the Halliburton Cyber Attack

• What happened in the Halliburton cyber attack?

  In August 2024, Halliburton - one of the world's largest oilfield services companies - disclosed in a regulatory filing to the US Securities and Exchange Commission (SEC) that it had detected a cyber attack on its systems. The incident, later attributed by US authorities to the RansomHub ransomware group, forced Halliburton to take certain systems offline and caused operational disruptions across multiple departments, with its north Houston campus and some global connectivity networks directly affected. The company continued delivering products and services using backup systems, and no oil production or field services were reported to be affected.

• When did the Halliburton cyber attack take place?

  Halliburton disclosed the attack in an SEC filing on 21 August 2024, with operational impact reported through 22-25 August 2024. The company officially confirmed the attack on 28 August 2024, and on 30 August 2024 US agencies issued a joint advisory naming RansomHub. Reports of ransom negotiations continued into early September 2024. Downtime and time to recover were each estimated at around a week.

• Who was behind the Halliburton cyber attack?

  The attack was attributed to RansomHub, a prolific ransomware-as-a-service group. Suspicion centred on RansomHub from the outset, and on 30 August 2024 a joint advisory from CISA, the FBI, the HHS and the Multi-State Information Sharing and Analysis Center (MS-ISAC) formally identified the group as responsible. The advisory noted that RansomHub had affected over 210 organisations across critical sectors including energy, water, healthcare and financial services.

• Was a ransom demanded in the Halliburton cyber attack?

  Reports from several outlets indicated that the attackers had exfiltrated sensitive data and were demanding a ransom of around $45 million, though Halliburton did not publicly verify this figure. By early September 2024, reporting suggested the company's legal and cybersecurity teams were negotiating with the attackers, with the details kept confidential. Halliburton has not publicly confirmed whether any ransom was paid.

• What data was stolen or exposed in the Halliburton breach?

  Halliburton confirmed that some data had been stolen during the incident. Reporting indicated that financial data, employee records and proprietary information may have been accessed, although the company did not publish a full breakdown of the affected data. Halliburton stated it would notify affected parties as appropriate while its forensic investigation, supported by external advisors, continued.

• How did the cyber attack impact Halliburton's operations?

  The attack caused operational disruptions across multiple departments. Employees reportedly lost access to critical systems, and some internal networks were taken offline as a precaution, affecting day-to-day operations at the company's north Houston campus and some global connectivity networks. Vendors and partners experienced slowdowns in communication and data transfers, creating supply-chain delays, although Halliburton continued to deliver products and services to customers using backup systems.

• Was oil production or field services affected by the attack?

  No. Despite significant disruption to corporate systems and the north Houston campus, reporting indicated that Halliburton's oil production and field services were not affected. The company maintained delivery of products and services to customers throughout the investigation, with the main impact felt in corporate IT, internal networks and supply-chain communications rather than in field operations.

• How did the cyber attack affect Halliburton's stock price?

  Halliburton's share price took a brief dip following the disclosure, reflecting investor concern over potential financial and reputational damage. News outlets reported that the stock fell by nearly 4%, reaching a new low for the year. Analysts estimated potential losses stemming from both the reported ransom demand and the disruption to business operations, although Halliburton did not publish an official cost figure at the time. 

• What is RansomHub, the group linked to the Halliburton attack?

  RansomHub is a ransomware-as-a-service operation that became one of the most active ransomware groups of 2024, targeting organisations across critical infrastructure sectors. In the Halliburton case, US agencies confirmed RansomHub's involvement and shared indicators of compromise (IOCs), including a Windows executable named maintenance.exe identified as a RansomHub ransomware encryptor. The joint advisory noted that the group had affected more than 210 organisations across sectors such as energy, water, healthcare and financial services.

• How long was Halliburton down and how long did recovery take?

  Downtime and time to recover were each estimated at around a week. From late August 2024, Halliburton proactively took certain systems offline to contain the incident, ran essential business functions on backup systems, and progressively restored services as its investigation continued. The company engaged Mandiant and other external advisors to support containment, forensic analysis and recovery. 

• How did Halliburton and government agencies respond to the attack?

  Halliburton activated its cybersecurity response plan, proactively took certain systems offline, engaged external advisors including Mandiant, and notified law enforcement. It reported the breach to the FBI and the Cybersecurity and Infrastructure Security Agency (CISA), and shared indicators of compromise with suppliers so they could detect related activity on their own networks. On 30 August 2024, CISA, the FBI, the HHS and MS-ISAC issued a joint advisory on RansomHub to help other organisations defend against similar attacks.

• What can organisations learn from the Halliburton cyber attack?

  The Halliburton incident shows how a ransomware attack on corporate IT can disrupt operations across multiple departments, strain supply chains and dent investor confidence, even when core production continues. The key lessons are the value of rapid containment and proactive system isolation, tested incident response plans, strong third-party and supply-chain risk management, early engagement with law enforcement and forensic specialists, and clear stakeholder communication. Cyber Management Alliance helps organisations build these capabilities through training, cyber crisis tabletop exercises and incident response planning.