2012 Saudi Aramco — Shamoon, 30K workstations
Data compromised
Corporate data; workstations wiped
Technical writeup
Shamoon malware infected ~30,000 workstations (~75% of PCs). Cutting Sword of Justice claimed responsibility. Malware wiped drives after exfiltrating data. Oil production systems on isolated networks unaffected. Restored within ~10 days.
Root cause
Malware; Shamoon; suspected insider assistance