Russia hack suspected as Wood staff bank and personal data accessed

Employ­ees of Aber­deen­headquartered engin­eer­ing giant Wood had their names, bank details and addresses exposed to hack­ers in a data breach, it has emerged.

The Press and Journal can reveal let­ters have been sent to cur­rent and former work­ers this week after an invest­ig­a­tion into the data breach.

The cyber attack is believed to have been led by a notori­ous Rus­sian e-crime group and took place in Octo­ber 2025.

Recip­i­ents were told their “Wood assigned employee num­ber, full name, bank account num­ber, bank sort code and address” were con­tained within the affected data.

The let­ter advises those impacted to use strong pass­words, change them reg­u­larly and enable mul­ti­factor authen­tic­a­tion on fin­an­cial accounts.

Work­ers have been urged to check bank accounts and credit card state­ments for unusual activ­ity. And they have been asked to remain alert to sus­pi­cious emails, texts and phone calls.

One former employee who con­tac­ted The Press and Journal said he was “really annoyed” that the only con­ces­sion being offered appeared to be a year’s sub­scrip­tion to a credit score mon­it­or­ing ser­vice.

At the foot of the let­ter, Wood says it has “secured the ser­vices” of credit ref­er­ence agency Equifax for those affected.

Wood said it is sup­port­ing those whose inform­a­tion was impacted.

In a state­ment, a spokes­per­son told The P&J: “In Octo­ber 2025, Wood iden­ti­fied that an external threat actor had exploited an Oracle zero-day vul­ner­ab­il­ity.

“It tem­por­ar­ily gained access to a lim­ited por­tion of Wood’s Oracle E-Busi­ness Suite (EBS) envir­on­ment.

“Wood was among a num­ber of organ­isa­tions glob­ally impacted by this incid­ent.

“Fol­low­ing an extens­ive invest­ig­a­tion sup­por­ted by lead­ing cyber secur­ity spe­cial­ists, Wood con­firmed the incid­ent was fully con­tained.

“There is no evid­ence of ongo­ing mali­cious activ­ity, no impact to com­pany oper­a­tions, and no impact to cli­ent project data or con­fid­en­tial cli­ent inform­a­tion.

“Wood is provid­ing rel­ev­ant inform­a­tion and sup­port to those impacted.”

Wood said an unau­thor­ised third party exploited the “Oracle zeroday vul­ner­ab­il­ity” to gain access to com­pany data in an Octo­ber breach last year. Oracle E-Busi­ness Suite is a soft­ware plat­form used by organ­isa­tions around the world to store and man­age employee and busi­ness data.

The term “zero-day” refers to a soft­ware flaw that is dis­covered and exploited before the soft­ware pro­vider has had a chance to develop and release a fix.

Cyber secur­ity com­pany Crowd­Strike con­firmed an attack on mul­tiple unnamed busi­nesses back in Octo­ber 2025.

It was not at that time clear Wood Group had been among the vic­tims.

Crowd­Strike said it was “mod­er­ately con­fid­ent” the attack had been car­ried out by Rus­sian e-crime group Grace­ful Spider. However, it did say mul­tiple hack­ing groups could have been involved.

Wood said there is no evid­ence the com­pany was spe­cific­ally tar­geted and it added that hun­dreds of organ­isa­tions world­wide were affected by the same vul­ner­ab­il­ity.

The com­pany also stressed that it has found “no evid­ence of any mis­use, or attemp­ted mis­use, of any impacted data”.

In its let­ter to staff, seen by The P&J, Wood adds: “Once Wood iden­ti­fied the issue, it promptly con­tained the incid­ent.

“We engaged lead­ing cyber secur­ity experts to con­duct an invest­ig­a­tion.

“And we imple­men­ted enhanced mon­it­or­ing to fur­ther strengthen our secur­ity meas­ures.”

Data breaches can affect busi­nesses, pub­lic bod­ies, char­it­ies and other organ­isa­tions, and have become increas­ingly com­mon in recent years.

A data breach occurs when unau­thor­ised indi­vidu­als gain access to inform­a­tion they should not be able to see.

In recent years, major com­pan­ies, hos­pit­als, gov­ern­ment agen­cies, retail­ers and uni­versit­ies have all fallen vic­tim.

Crim­in­als may demand a ransom, use stolen inform­a­tion to launch phish­ing scams or sell data to other offend­ers.

A high-pro­file example in recnet years was an attack on Marks & Spen­cer in 2025 when hack­ers dis­rup­ted orders and internal sys­tems.

The Press and Journal (Aberdeen and Aberdeenshire), 10 Hydref 2026

Tanysgrifiwch i Premium a chael mynediad digidol i The Press and Journal (Aberdeen and Aberdeenshire) a miloedd o bapurau newydd a chylchgronau eraill