Halliburton confirmed that an unauthorized third party accessed some of its systems and accessed and exfiltrated information during a cyberattack discovered on August 21, 2024. The company did not publicly identify the stolen data, the number of affected records or people, the attacker, or whether a ransom was paid.
The incident disrupted portions of Halliburton’s business applications, but the company said it continued providing products and services globally. Later filings described the event as a material cybersecurity incident that generated significant costs and required substantial management attention.
What Halliburton confirmed
In an August 30, 2024 Form 8-K made public on September 3, Halliburton said an unauthorized third party had accessed certain company systems and that information had been accessed and exfiltrated from them.
That disclosure establishes two important facts:
- Unauthorized access occurred. Someone gained access to at least some Halliburton systems without permission.
- Information was exfiltrated. Data was taken from those systems, rather than merely viewed or exposed temporarily.
However, the filing did not establish that the stolen information included Social Security numbers, customer credentials, financial-account details, health information, trade secrets, or oilfield data. Halliburton said it was still evaluating the nature and scope of the information and determining what notifications might be required.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute#1 Best Overall
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 3 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Halliburton cyberattack timeline
| Date | What happened |
|---|---|
| August 21, 2024 | Halliburton discovered that an unauthorized third party had accessed certain systems. The company activated its cybersecurity response plan, took certain systems offline, notified law enforcement, and began investigation and restoration work. Halliburton’s initial filing |
| August 30, 2024 | Halliburton filed an updated Form 8-K describing accessed and exfiltrated information, operational disruption, and its assessment of notification obligations. Updated filing |
| September 3, 2024 | The updated disclosure became publicly available and received widespread media coverage. |
| February 12, 2025 | Halliburton’s 2024 Form 10-K described the event as a material cybersecurity incident and discussed disruption, costs, and management attention. 2024 Form 10-K |
| February 2026 | Halliburton’s 2025 Form 10-K continued to reference the 2024 incident as part of its cybersecurity risk disclosures. 2025 Form 10-K |
What systems and operations were affected?
Halliburton said the incident disrupted and limited access to portions of its business applications supporting aspects of operations and corporate functions. The company took certain systems offline as part of its response.
The public disclosure does not support claims that all Halliburton systems went offline or that the company’s global oilfield-services operations completely stopped. Halliburton said it continued providing products and services to customers globally while it worked to identify the effects on ongoing operations.
What data was stolen?
Halliburton did not publicly specify the type or amount of data that was stolen in the cited disclosures.
The filing did not state:
- How many records or individuals were affected
- Whether employee or customer personal information was involved
- Whether financial, health, benefits, or identification data was taken
- Whether confidential technical or commercial information was exfiltrated
- Whether a specific population had been notified
“Exfiltrated information” confirms that data left company systems. It does not, by itself, identify the contents of that data or prove that a personal-data breach affecting consumers occurred.
Rank #2
- Enterprise-grade prevention, detection, correlation and response from the perimeter to the endpoint with our Total Security Suite.
- Gain critical insights about network security, from anywhere and at any time, with WatchGuard Cloud.
- Built-in compliance reports, including PCI and HIPAA, mean one-click access to the data you need to ensure compliance requirements are met.
- Up to 18 Gbps firewall throughput. Turn on all additional security services and still see up to 2.4 Gbps throughput.
Was the Halliburton incident ransomware?
The incident was widely reported as a ransomware attack and was linked in security reporting to the RansomHub group. TechCrunch, SecurityWeek, and BleepingComputer reported on the alleged connection and a purported ransom note claiming that files had been encrypted and stolen.
Halliburton’s cited SEC filing, however, did not formally identify RansomHub or definitively describe the event as ransomware. The reviewed public record also does not establish that Halliburton paid a ransom.
The most accurate description is: Halliburton confirmed unauthorized access, data exfiltration, and operational disruption; security publications reported a possible RansomHub ransomware connection, but the company did not publicly confirm that attribution in the cited filing.
See the contemporary reporting from TechCrunch, SecurityWeek, and BleepingComputer.
Recommended Free Tools
Rank #3
- Entry-Level Privacy Gateway: Designed for users who want simple online privacy protection at an affordable level—ideal for basic home networking and daily internet use.
- Secure Browsing for Everyday Needs: Perfect for email, social media, online shopping, and standard streaming—protecting your connection while keeping setup and operation easy.
- Lightweight Protection Against Common Online Threats: Helps reduce exposure to unwanted ads, trackers, and risky websites, improving online safety for your household.
- Simple Setup, No Technical Skills Required: Plug it in, follow the quick steps, and start using—an excellent choice for beginners who don’t want complicated network configurations.
- Decentralized VPN (DPN) Included – No Monthly Payments: Get built-in decentralized VPN access with lifetime free usage, helping you stay private without paying recurring subscription fees
Did Halliburton notify affected people?
Halliburton confirmed that it notified law enforcement and communicated with customers and stakeholders about the incident. Its August 30 filing said it was still determining what breach notifications might be required.
That is different from confirming that a particular group of employees, customers, or other individuals had received legally required breach notices. The reviewed sources do not establish a specific affected population or a public consumer notification program.
People who believe they may be affected should rely on verified Halliburton communications or official regulator notices rather than unsolicited emails, text messages, or calls referring to the attack. Cyber incidents often create opportunities for follow-up phishing and impersonation scams.
How serious was the business impact?
Halliburton’s August 30 filing said the incident had not had, and was not reasonably likely at that time to have, a material impact on the company’s financial condition or results of operations. That statement did not mean the incident had no cost or operational effect.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #4
- Single appliance with integrated firewalling, SD-WAN and Wi-Fi controller reduces complexity of WLAN management. Its zero-touch deployment helps optimize your onboarding experience.
- Built on a patented secure processor, this compact network firewall delivers the highest level of security and performance in its class – 800 Mbps IPS | 500 Mbps threat protection.
- User-friendly management console gives you centralized visibility and simplifies policy enforcement across your network. Its zero-touch deployment helps you optimize your onboarding experience.
- Compact and fanless design equipped with 4 GE RJ45 ports (1 WAN port and 3 internal ports) provide essential connectivity and flexibility for various network configurations in a small-scale environment.
- Including award-winning FortiGate hardware and 3-year FortiGuard AI-powered UTP security services. Services cover IPS, Advanced Malware Protection, Application Control, URL, DNS & Video Filtering, Antispam Service, and FortiCare Premium customer support.
The same filing described disruption and limited access to parts of the company’s applications, response expenses, and risks including litigation and regulatory scrutiny. Halliburton later stated in its 2024 Form 10-K that the event caused significant costs and required substantial management and workforce attention.
These statements are not necessarily contradictory. A material cybersecurity incident is a disclosure classification concerning the significance of a cyber event. A material impact on financial condition or results is a separate assessment of whether the event is expected to significantly affect financial performance.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What Halliburton disclosed later
Halliburton’s 2024 Form 10-K said the company had experienced unauthorized access and exfiltration, that the event disrupted portions of business applications, and that it generated significant costs and management attention. It also warned of potentially unknown impacts, regulatory action, and litigation.
Halliburton’s 2025 Form 10-K continued to reference the 2024 event and its cybersecurity implications. That continued disclosure shows that the incident remained part of the company’s reported cyber-risk history as of the year ended December 31, 2025.
It does not prove that the intrusion was still active in 2026. The filings support continuing disclosure of the incident’s consequences and risks, not an ongoing compromise.
What customers, employees, and investors should do
Customers and business partners
- Verify incident-related messages through known Halliburton contacts, not links or phone numbers supplied in an unexpected message.
- Review credentials, remote access, vendor accounts, and integrations connected to Halliburton systems.
- Ask your organization’s security or procurement team whether it received formal incident guidance.
Employees and individuals
- Do not assume that personal information was exposed unless you receive a formal notice confirming it.
- Be cautious of phishing messages offering credit monitoring, password resets, refunds, or incident updates.
- If an official notice confirms exposure of credentials or financial information, follow its specific remediation instructions, including password changes and account monitoring.
Investors
Read the company’s SEC disclosures in sequence. The initial filings provide the incident facts and immediate financial assessment; the later Form 10-Ks add information about costs, management attention, legal exposure, and continuing risk. Do not treat the term “material cybersecurity incident” alone as proof of a material financial loss.
What remains unknown
Based on the cited public disclosures, the following questions remain unresolved:
- The precise categories of information stolen
- The number of affected records or individuals
- Whether customer or employee personal data was involved
- The attacker’s confirmed identity
- Whether the incident was definitively ransomware
- Whether Halliburton paid a ransom
- The complete scope of any required notifications
Those limits matter. Reporting that “data was stolen” is accurate, but expanding that statement into a confirmed personal-data breach, customer-data breach, or confirmed RansomHub attack goes beyond what Halliburton established in the cited filing.
Free tools Windows power users keep installed
One-click scans. No signup required.
Bottom line
Halliburton confirmed that attackers accessed some company systems and exfiltrated information during an incident discovered on August 21, 2024. The attack disrupted portions of business applications, while Halliburton said it continued providing services globally. Later filings described significant costs and management attention.
The public record reviewed here does not identify what data was stolen, how many people were affected, whether personal information was involved, whether RansomHub was definitively responsible, or whether a ransom was paid. Those are the key distinctions readers should keep in mind when evaluating reports about the Halliburton cyberattack.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
