2 min read
The PPL cyberattack has brought one of Pakistan’s largest state-run energy companies to its knees. Hackers calling themselves Blue Locker have crippled Pakistan Petroleum Limited’s IT systems for the past two days, encrypting servers, deleting backups, and issuing a chilling ransom demand.
The attackers claim to have stolen sensitive operational. They have also allegedly taken contractual, and employee data, threatening to leak it unless they receive direct payment. The company’s financial operations remain at a complete standstill, sparking concerns across the national energy sector.
Hackers Issue Direct Threats
In a threatening email sent to employees, the hackers warned:
“Your computers and servers are encrypted, backups are deleted from your network and copied. We have stolen some of your business data and employee information… If you don’t contact us with a quote, we will report the hack to mainstream media and release your data to social media and competitors.”
The message also cautioned against any independent recovery attempts, claiming such actions could lead to permanent data loss.
PPL Responds, Says Core Systems Unaffected
PPL confirmed detecting a ransomware intrusion on August 6, 2025, triggering internal cybersecurity protocols. In an official statement, the company said its IT and security teams, alongside external experts, contained the threat by temporarily suspending select non-critical IT services.
The company stressed that its multi-layered cybersecurity systems isolated the threat, finding no evidence of any compromised business-critical or sensitive data. PPL maintains that core operational systems and business-critical data remain unaffected, and its joint venture partners continue to operate normally. The company also reported the attack to law enforcement and regulatory bodies and has launched a comprehensive forensic investigation.
PPL also addressed circulating misinformation on social media, clarifying that the ransom note came from an external actor identified as “Proton,” not Blue Locker. No contact has been made with the hackers, and investigations with law enforcement and regulators are ongoing.
