Exclusive: Bank details, names and addresses of Wood Group employees stolen by hackers

Employees of Aberdeen-headquartered engineering giant Wood had their names, bank details and addresses exposed to hackers in a data breach, it has emerged.

The Press and Journal can reveal letters have been sent to current and former workers this week after an investigation into the data breach.

The hacking attack is believed to have been led by a notorious Russian e-crime group and took place in October 2025.

Recipients were told their “Wood assigned employee number, full name, bank account number, bank sort code and address” were contained within the affected data.

The letter advises those impacted to use strong passwords, change them regularly and enable multi-factor authentication on financial accounts.

Workers have been urged to check bank accounts and credit card statements for unusual activity.

And they have been asked to remain alert to suspicious emails, texts and phone calls.

One former employee who contacted The Press and Journal said he was “really annoyed” that the only compensation being offered appeared to be a year’s subscription to a credit score monitoring service.

At the foot of the letter, Wood says it has “secured the services” of credit reference agency Equifax for those affected.

Wood issues statement over data breach

Wood said it is supporting those whose information was impacted.

In a statement, a spokesperson told The P&J: “In October 2025, Wood identified that an external threat actor had exploited an Oracle zero-day vulnerability.

“It temporarily gained access to a limited portion of Wood’s Oracle E-Business Suite (EBS) environment.

“Wood was among a number of organisations globally impacted by this incident.

“Following an extensive investigation supported by leading cyber security specialists, Wood confirmed the incident was fully contained.

“There is no evidence of ongoing malicious activity, no impact to company operations, and no impact to client project data or confidential client information.

“Wood is providing relevant information and support to those impacted.”

Leak carried out by criminal group ‘Graceful Spider’

Wood said an unauthorised third party exploited an “Oracle zero-day vulnerability” to gain access to company data in an October breach last year.

Oracle E-Business Suite is a software platform used by organisations around the world to store and manage employee and business data.

The term “zero-day” refers to a software flaw that is discovered and exploited before the software provider has had a chance to develop and release a fix.

Cyber security company Crowdstrike confirmed an attack on multiple unnamed businesses back in October 2025.

It was not at that time clear Wood Group had been among the victims.

Crowdstrike said they were “moderately confident” the attack had been carried out by Russian e-crime group Graceful Spider .

But they did say multiple hacking groups could have been involved.

Wood said there is no evidence the company was specifically targeted.

And it added that hundreds of organisations worldwide were affected by the same vulnerability.

The company also stressed that it has found “no evidence of any misuse, or attempted misuse, of any impacted data”.

In its letter to staff, seen by The P&J, Wood adds: “Once Wood identified the issue, it promptly contained the incident.

“We engaged leading cyber security experts to conduct an investigation.

“And we implemented enhanced monitoring to further strengthen its security measures.”

How common are data breaches and why do they happen?

Data breaches can affect businesses, public bodies, charities and other organisations, and have become increasingly common in recent years.

A data breach occurs when unauthorised individuals gain access to information they should not be able to see.

They are typically caused by:

Software vulnerabilities

Weak security controls

Deliberate insider actions

Large organisations are frequent targets because cyber criminals know they hold valuable personal and financial information.

Most attacks are unsuccessful.

But some do succeed – like the Wood data breach.

In recent years, major companies, hospitals, government agencies, retailers and universities have all fallen victim.

Criminals may demand a ransom, use stolen information to launch phishing scams or sell data to other offenders.

One of the most famous recent examples is the attack on Marks and Spencer in 2025 .

Hackers disrupted online orders and internal systems.

Their activities caused major operational problems for the High Street chain.

And customer data including names, addresses and order histories were all accessed.

The likes of Harrods and the Co-op are other examples from 2025.

Within the past week, fashion retailer Asos revealed to customers it had fallen victim to cyber criminals.

The BBC reported on Thursday that: “Names, addresses, phone numbers, emails, customer numbers and dates of birth are now in the hands of criminals” .