Documented social engineering incidents targeting the critical infrastructure, energy & utilities sector, sourced and fact-checked.
An attack attributed to Russia's Sandworm Team used compromised credentials to remotely open substation breakers at three Ukrainian utilities and cut power to about 225,000 customers. Government investigators reported BlackEnergy infections but did not confirm the malware's role in acquiring the credentials.
DocumentedThe CEO of a UK energy firm was tricked into wiring €220,000 (~$243,000) to a Hungarian account in March 2019 after a phone call using AI-cloned audio of his German parent company's own CEO's voice, marking the first widely reported criminal use of AI voice-cloning technology, disclosed by insurer Euler Hermes.
DocumentedA nation-state cyberweapon crossed an air gap into Iran's Natanz nuclear facility on infected USB drives, first through a recruited insider and later on media carried in by unwitting contractors, then physically destroyed roughly 1,000 uranium centrifuges.
DocumentedFraudsters posing as Tecnimont's group CEO, other executives, and a fictitious Swiss lawyer used spoofed emails and a staged series of conference calls about a fake confidential China acquisition to talk the Indian subsidiary's head into wiring $18.6 million to Hong Kong accounts in November 2018.
DocumentedSCE reported $131,464 collected by scammers across its 2025 customer fraud complaints. Its warnings describe immediate-disconnection and meter-removal threats as examples of utility impersonation, not as the proven mechanism behind every reported loss.
Reported/allegedNINJIO's training account connects a badge surfer photographing passwords to the 2012 Saudi Aramco Shamoon attack. The sources reviewed here do not independently corroborate that physical-access claim. The destructive malware incident is documented, but its entry method and the training story must be kept separate.
DocumentedA compromised email sent a Wheeling, WV nonprofit a fake solar panel invoice. It paid $30,750 to an Oklahoma man's account, who later admitted wire fraud.
DocumentedIn the PG&E scam, a caller claiming to be from the utility threatens to cut the power today. Then a barcode or QR code arrives by text or email, with orders to pay it at a store checkout. By the middle of 2026, PG&E customers had reported more than $211,000 in losses, and the company suspects the barcode trick is part of why.
Reported/allegedAn unidentified operator jailbroke Anthropic's Claude Code with a fake "authorized bug bounty and penetration test" pretext, then defeated its refusal by handing it a 1,084-line attack playbook as a file to save, which loaded automatically into every later session; Gambit Security reconstructed the result as a human-directed campaign that used Claude Code and OpenAI's GPT-4.1 against nine Mexican government bodies. Anthropic confirmed the misuse of its platform and banned the accounts, but every named victim that has responded denies being breached and no Mexican authority has confirmed it.
DocumentedArgan's Fiscal 2024 cybersecurity disclosure described fraudulently induced outbound wire transfers in March 2023 and reported $2.7 million of loss, net of recovered funds and including related professional fees.
Social Engineering Examples