MalwareEnergy & UtilitiesUtilitiesRansomwareAkiraSupply Chain (3P Vendor)Data ExfiltratedEmployee Data InvolvedDelayed DiscoveryIdentity (basic)Government IDHealth (basic)MediumContained

CITGO PETROLEUM CORPORATION

bd_d6ceb784b0c5331e · schema v1 · pii pii-v2

Severity

Medium

Discovered

Jan 27, 2026

Filed

Aug 31, 2026

To disclose

31 weeks

Affected

1state residents only

Confidence

69%

Full breach record for CITGO PETROLEUM CORPORATION →3 incidents on file

CITGO Petroleum Corporation notified the NH Attorney General of a data breach affecting one NH resident. The incident occurred at Paylogix, LLC, a subcontractor of CITGO's vendor Mercer. Ransomware activity was identified in November 2025, with unauthorized access between Nov 13-18, 2025. CITGO first learned of the incident on Jan 27, 2026, via a law firm advertisement. Affected data includes name, SSN, DOB, and health insurance info. The threat actor is associated with the 'Akira' group. CITGO is offering 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 75 days

discovery → filing · 31 weeks / 216 days

Nov 13, 2025

Begins

Jan 27, 2026

Discovered

Aug 31, 2026

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: CITGO PETROLEUM CORPORATION
norm: citgo petroleum

Name: CITGO PETROLEUM CORPORATION
norm: citgo petroleum
Industry: Energy & Utilitiesllm

Discovered: Jan 27, 2026
Breach occurred: Nov 13, 2025 – Nov 18, 2025
Undetected for: 75 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 26, 2026
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Attack vector: Ransomware· Akira
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: AkiraExternalFinancial
Regulator citations: Notified New Hampshire Attorney General

During the incident: Contacted Mercer to learn more about the incident
Contacted Paylogix directly and through Mercer at least eleven more times seeking information
Issued three formal legal demands to Paylogix
Working with Paylogix to confirm the implementation and effectiveness of additional security measures
Offering affected individuals 24 months of complimentary Epiq 3-Bureau Credit Monitoring - Plus
Changes made: Paylogix implemented measures to contain the incident and secure its environment
Paylogix implemented additional security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 31 weeks(216 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/citgo-petroleum-20260831.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 31, 2026
Raw hash: 0948cdd4748464a43763544b3918886a0adc6a240a9cfc72274aa2b4980ad7a8

Reporting entityCITGO PETROLEUM CORPORATION

Victim entityCITGO PETROLEUM CORPORATION

Incidentdiscovered Jan 27, 2026

Stated responseContacted Mercer to learn more about the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov