# GE Vernova ransomware victim disclosure

Published: 2026-09-25 · Severity: high · Sectors: energy
Canonical: https://vorant.io/reports/aa36b6ac-e869-5795-a4d7-ab22313bde20/ge-vernova-ransomware-victim-disclosure

> GE Vernova Inc. disclosed as ransomware victim with 203 compromised user accounts and exposed attack surface.

GE Vernova Inc. has been disclosed as a victim of a ransomware attack via the metaencryptor ransomware group's listing on ransomware.live. The breach involved compromise of 203 user accounts, 18 third-party employee credentials, and an external attack surface of 30 exposed assets including DNS records. No additional operational details regarding the attack vector, timeline, or data exfiltration specifics are provided in the public disclosure. Defenders in the energy sector should monitor for indicators of compromise related to GE Vernova's infrastructure and consider whether their own organizations have overlapping third-party relationships or shared services that may have been leveraged in this attack.

## Mentioned in this report

- Threat actors: metaencryptor
- Malware: Metaencryptor

1 detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.ransomware.live/id/R0UgVmVybm92YSBJbmMuQG1ldGFlbmNyeXB0b3I=

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/aa36b6ac-e869-5795-a4d7-ab22313bde20/ge-vernova-ransomware-victim-disclosure.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup