Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRosneft Deutschland, the German petroleum distribution and trading subsidiary of Russian oil company Rosneft, suffered a cyberattack on March 11, 2022, during the first weeks of Russia’s full-scale invasion of Ukraine. The company shut down systems considered compromised and restored essential services to emergency operation. The BSI later said the incident caused no perceptible supply shortages; Anonymous’s claim that it stole 20 terabytes of data was not confirmed at that scale.
What happened to Rosneft Deutschland?
The BSI’s retrospective account dates the attack to March 11, 2022. In contemporaneous reporting on March 14, AFP said Rosneft Deutschland had notified Germany’s Federal Office for Information Security (BSI) early on Saturday, March 12. These dates describe the reported attack and the company’s notification, respectively.
The BSI later said a large volume of data had been extracted from storage systems, mail servers and hard-disk images. It also reported that the operator shut down its systems after they had to be treated as compromised. The incident was therefore more than a public claim of a breach: the BSI’s later account confirms data extraction and an operational response, without identifying the technical route used to gain access.
Who claimed responsibility, and was 20 terabytes confirmed?
Anonymous claimed responsibility on Friday, March 11, according to AFP, and said it had taken 20 terabytes of data. The BSI newsletter also summarized that claim. The BSI’s later account confirms that a large volume of data was extracted, but does not verify the specific 20-terabyte figure. That number should be treated as Anonymous’s claim, not as a confirmed forensic total.
#1 Best Overall
AFP quoted Anonymous’s stated rationale: “But Rosneft Germany is interesting enough,” it added. This was the group’s own framing; the available accounts do not independently establish a motive or confirm who carried out the attack.
Did the attack disrupt oil supplies?
The BSI said there were no perceptible supply shortages. AFP’s March 14 report likewise said pipelines and refineries continued operating normally. The BSI cautioned that a prolonged disruption could have caused economic damage and supply constraints, but described those as possible consequences, not effects that occurred.
AFP reported that Rosneft Deutschland said it accounted for around one quarter of Germany’s crude oil imports in recent years and held stakes in three refineries. The import share was the company’s stated context as reported in 2022, not an independently verified figure for the date of the attack.
How did the company respond?
According to the BSI’s 2022 retrospective, the operator shut down systems that had to be considered compromised. With outside support, necessary systems were restored to emergency operation. The BSI said authorities helped resolve uncertainty about service-provider support and how sanctions should be interpreted. Its report describes support from an external BSI-qualified APT provider but does not name that provider.
Rank #3
What is known about the investigation?
AFP reported, citing Der Spiegel, that prosecutors in Berlin had opened an investigation. The accounts cited here do not establish its final outcome; they provide no basis to claim an arrest, charge or prosecution result.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the incident does—and does not—show
The BSI’s archived cyber-situation assessment described Germany’s threat as elevated and urged organizations to review and adapt information-security measures. That is broader threat context, not evidence about how the Rosneft Deutschland attack was carried out.
Quick Recap
Best Value
- Established by the BSI: a March 11 attack, substantial data extraction, shutdown of compromised systems, emergency restoration and no perceptible supply shortages.
- Attributed to Anonymous: responsibility for the attack and the specific claim of 20 terabytes taken.
- Not established in these accounts: the initial access method, malware, independently verified attacker identity, a confirmed 20-terabyte total or the investigation’s final outcome.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
