Oldelval reports cyber incident

Oldelval told Argentina's National Securities Commission that it had suffered a cyber incident affecting certain administrative systems, while stressing that crude oil transport was not interrupted.

Scope of the incident

According to Ámbito's coverage, the company activated its cybersecurity protocols after detecting the event and later restored all of the platforms involved. The impact was concentrated in administrative systems and did not affect the continuity of the pipeline's operations.

Attribution remains disputed

Defonline reported that the leading theory on attribution points to The Gentlemen, citing Microsoft Threat Intelligence, which identifies the actor under the alias Storm-2697. That attribution should be read as a hypothesis or claim reflected in the available coverage, not as an independent official confirmation.

The case adds to a broader set of public ransomware records tied to activity observed in Argentina. Available sources include maps and profiles of groups such as Ransomware.live, with specific references to Akira, Thegentlemen and Threeam, along with an aggregate review of victims and groups observed in the country. Those data point to a sector-specific focus and to TTPs documented for Akira and The Gentlemen, although the material provided does not include an Argentine primary source detailing a local incident beyond what was reported about Oldelval.