The Saudi company confirmed to BleepingComputer that the data breach, which the hackers say was made last year.
The Kingdom’s state oil firm also said that the data breach was at third-party contractors, not on Aramco’s systems.
“Aramco recently became aware of the indirect release of a limited amount of company data which was held by third-party contractors,” the company told BleepingComputer.
The threat group, identified as ZeroX, is offering for sale on the darknet the data it claims to have gained by hacking Aramco’s “network and its servers” at some point last year.
The data up for sale at a starting negotiable price of $5 million includes documents pertaining to Saudi Aramco refineries, personal information about more than 14,000 employees, project specifications for systems, pricing sheets and internal analyses, as well as security-related information including IP addresses, Wi-Fi access points, and IoT devices, ZeroX told BleepingComputer.
The group claims it has been negotiating the sale of the data with five potentially interested buyers, ZeroX told BleepingComputer.
HJ/PR