An August 2024 cyberattack restricted Halliburton’s business applications and corporate functions and involved data theft. The company used manual workarounds and later described restored systems; independent technical reporting linked the attack to RansomHub.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Unauthorized access to systems, accounts, networks, or data.
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Internal or external network connectivity was unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
A specific application or software platform became unavailable or unusable.
Business, financial, customer, administrative, or operational transactions could not be completed normally.
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
Services continued but with longer processing, response, delivery, or completion times.
The disruption caused an accumulation of unprocessed requests, cases, orders, records, appointments, or other work.
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
The incident caused operational effects at customers, affiliates, subsidiaries, partners, tenants, or other dependent organizations.
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Halliburton experienced a confirmed August 2024 cyberattack that restricted business applications, disrupted corporate functions and involved information theft. Its initial SEC filing says it discovered unauthorized access Aug. 21 and took some systems offline. Reuters’ contemporaneous report described effects at the north Houston campus and on global connectivity, attributing those details to a person familiar with the incident.
The incident is resolved on the strength of the chief financial officer’s Nov. 7 earnings-call account that systems had been restored. He described finance and procurement teams subsequently catching up on transactions handled manually. The exact restoration day is unconfirmed.
The company’s Sept. 3 update confirms limited access to business applications supporting operations and corporate functions while restoration continued. BleepingComputer’s original reporting describes invoice and purchase-order difficulties and a supplier workaround. The supplier communication said email remained operational, and Halliburton said it continued providing products and services globally.
The third-quarter filing records $35 million in response expenses, including outside advisers, remediation, legal and payroll costs. In its later SEC correspondence, Halliburton explains that critical-system outages and the scope of information taken made the incident material to investors. Its separate assessment of financial-statement impact does not negate the operational disruption or mean the cybersecurity incident was immaterial. The 2025 annual filing later reports a $10 million release of accruals associated with the incident. That accounting adjustment is separate from an insurance recovery or an exact measure of the attack’s total cost.
Halliburton’s quarterly filing affirmatively confirms information exfiltration. BleepingComputer links a technical indicator supplied in the company’s response communications to a RansomHub encryptor, supporting a ransomware assessment and a reported attribution to that operation. Halliburton did not publicly confirm the actor in the reviewed filings, and the technical evidence does not independently establish which affiliate conducted the intrusion or prove that every inaccessible file was encrypted.
The earnings-call account supports manual processing, delayed billing and collections, and subsequent transaction catch-up. Management attributed a separate earnings effect jointly to the cyberattack and Gulf of Mexico storms; it also described multiple causes of a delayed software rollout. Neither combined figure should be presented as an attack-only loss, and the rollout’s revised schedule does not establish a continuing cyber outage.
Aug. 21 is the discovery date and earliest reviewed public cyber characterization, rather than a verified intrusion onset. Reuters’ source characterized a cyberattack while the company’s initial quoted response described a systems issue; the company explicitly acknowledged unauthorized access in its filing published Aug. 23. The Sept. 3 filing is the latest precisely dated ongoing restoration observation. Later quarterly expense disclosures and retrospective recovery statements do not supply an exact last outage day.
The initial-access route, full scope of information taken, duration of individual application failures and final restoration date remain uncertain. A public ransomware victim listing, leak-site publication date, ransom amount and payment outcome remain unconfirmed. Attribution to RansomHub rests on the reported technical evidence.
BleepingComputer reported a RansomHub link after analyzing an executable identified in Halliburton’s supplier communication. This is a reported technical attribution; Halliburton has not identified the actor in its cited filings. A public victim listing, actor-publication date, ransom amount and payment outcome remain unconfirmed.
Harris County contains Halliburton’s affected North Belt headquarters campus at 3000 North Sam Houston Parkway East. The association concerns the company site and does not establish disruption of county government or other local organizations.
Halliburton’s north Houston headquarters campus was affected, according to Reuters’ source. This identifies the company site rather than a citywide outage.
We reported an Aug. 21 cyberattack affecting Halliburton’s north Houston campus and global networks, with employees advised against connecting to internal networks while outside specialists assisted.
An unnamed source describes a cyberattack affecting Halliburton’s north Houston campus and global connectivity. Halliburton acknowledges an issue affecting certain systems and says it is working with outside experts.
Halliburton says it discovered unauthorized access Aug. 21, activated its response plan, brought in outside advisers, notified law enforcement and proactively took certain systems offline while restoration and investigation continued.
Reports that Halliburton’s supplier communication described Mandiant’s involvement, working email, purchase-order workarounds and technical indicators. The reporter links an indicated executable to RansomHub ransomware.
Halliburton reports disrupted access to business applications supporting operations and corporate functions, continuing restoration and suspected information exfiltration. It says it continues providing products and services globally.
The chief financial officer describes restored systems and finance and procurement teams entering transactions handled manually. Executives also describe delayed billing and collections and a combined cyberattack-and-storm earnings effect.
Halliburton confirms information exfiltration and records $35 million in incident-response expenses, including outside advisers, remediation, legal and payroll costs.
The annual filing records $35 million in cybersecurity incident expenses for 2024 and a $10 million release of related accruals in 2025.
Halliburton explains that outages of critical business systems and applications, together with the nature and scope of information taken, contributed to its determination that the incident was material to investors.
Signed-in members can report an error, update, or missing source.
