Skip to content
DysruptionHub
Sign in Subscribe

ENGlobal cyberattack restricts business systems for six weeks

Summary

ENGlobal Corporation logo

Unauthorized access and file encryption disrupted ENGlobal’s business applications, including financial and operating reporting, for about six weeks. The contractor reported restoration in January 2025 and planned personal-information notifications.

Key facts

Timeline

  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted location

Organization types

Critical infrastructure sector

DysruptionHub coverage

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Resolved
Incident confidence:
High
Ransomware:
Unresolved

Attack mechanisms

Data impacts

  • Unauthorized data access

    An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.

  • Data encryption

    Data was rendered inaccessible through unauthorized encryption, including ransomware-related encryption.

  • Data unavailable

    Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.

Operational impacts

  • Partial service outage

    A service, system, platform, or operational capability remained available only in part or with significant limitations.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Application unavailable

    A specific application or software platform became unavailable or unusable.

  • Records access disruption

    Staff, customers, patients, students, residents, or other users could not access records or case information normally.

  • Staff unable to work normally

    Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.

Extortion indicators

  • Unknown extortion indicators

    The incident may involve extortion, but available evidence does not establish which extortion indicators were present.

Incident narrative

Unauthorized access and file encryption

ENGlobal, an engineering and automation contractor, detected a cyber incident Nov. 25, 2024. In its Dec. 2 SEC disclosure, the company said an intruder accessed its IT system and encrypted some files.

ENGlobal restricted system access to essential business operations, opened an internal investigation and hired outside cybersecurity specialists. Full restoration timing was uncertain when it made that disclosure.

Business systems were restricted for about six weeks

A Jan. 27, 2025, amended filing said the incident limited access to business applications supporting operations and corporate functions, including financial and operating reporting, for approximately six weeks.

By that filing, ENGlobal said operations and corporate functions had been fully restored and it believed the intruder no longer had access. The filing does not give an exact restoration date. The approximate duration does not establish a precise end date.

Personal information and remaining uncertainty

The amendment said the intruder accessed a part of the system containing sensitive personal information. ENGlobal planned to notify affected or potentially affected parties and regulators as required. It did not specify affected-person totals or information categories.

The company said, based on information available at the time, that it did not expect a material financial impact beyond what it disclosed. That assessment does not negate the documented operational disruption or establish that recovery cost nothing.

The Record’s Jan. 28 report characterized the attack as ransomware and reported no public claim by a ransomware group at that time. The reviewed company disclosures establish unauthorized access and encryption, but do not identify a malware family, a ransom demand, payment or confirmed data theft.

Organizations involved

Impacted location

  • Houston, Texas

    Houston is the confirmed principal executive office city of the company whose corporate and financial-reporting applications were disrupted. This identifies its affected organizational site; the reviewed sources do not locate the compromised servers or establish a citywide or offsite customer outage.

Sources

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.