BlastWaveBlastWaveHACKOPEDIA
Hackopedia • File 034
United States and global

Halliburton Cybersecurity Incident (2024)

Volume 2Oil and Gas edition2024Last verified 13 sources, 10 primaryLinked to RansomHub by press only

In August 2024 an intruder reached Halliburton's business applications and took information. The company says it kept serving customers worldwide. What stopped, on the record, was the invoice, not the oilfield.

Halliburton is here as a counter-example. Everything on its record is corporate: disruption to “portions of the Company's business applications,” information taken, and, in the same filing, that it “continues to provide its products and services to customers globally.” Its finance chief located the damage: outages that hit the ability to invoice and collect. SEC staff asked why it used the material incident item while calling the financial effect immaterial. Halliburton answered that no factor was necessarily material on its own, but together they were. Material, but not on the money alone.

The record shows the field kept serving customers; it does not show how. BlastWave's reading, which is analysis and not a disclosed fact: the systems that gate field work did not wait on the systems that went down. That is the fallback this volume keeps asking about, and here it seems to have held. The lesson is to make it a design property rather than a result.

What is not known: Halliburton has not said how the intruder got in, which systems went offline or for how long, or what information was taken and whose. It names no attacker. RansomHub is linked only through a partial ransom note and a file identification, both as reported by BleepingComputer; the federal RansomHub advisory names no victim. The two cents a share of lost or delayed revenue is blended with Gulf of Mexico storms. Whether any field job was late is not on the record.

Recommendation

  1. Take the path away Scheduling, dispatch and anything a crew needs before it rolls should not share a network or identity plane with invoicing, purchasing and email.
  2. Remove standing access to the job No always-on remote path or shared administrator identity should reach from the business network into field, fleet or customer-connected systems.
  3. Send field data one way to billing Job data flows one way to the systems that invoice, so billing reads the work without reaching back, and crews can write tickets by hand when billing is gone.
The Front Desk
Podcast · Joe and Cam · 9:22
Halliburton Short
Video · 60 to 90 seconds

Sources: Form 8-K, 23 Aug 2024 (Item 8.01); Form 8-K, 3 Sep 2024 (Item 1.05); SEC staff letter, 17 Oct 2024; CORRESP, 15 Nov 2024; Q3 2024 Form 10-Q, Note 2; Q3 2024 call, 7 Nov 2024 (transcript); CISA AA24-242A, 29 Aug 2024. Full list with links.

Soft Spots: Why the field kept working is BlastWave's analysis, not disclosed. “Not on the money alone” compresses a reply that weighed quantitative and qualitative factors. Call quotes rest on third-party transcripts.

The full record

Every claim numbered to its source. Last updated .

An intruder reached Halliburton's business applications and took information, while the company said it kept serving customers worldwide. What is verified, what is only reported, and what is still unknown.

Summary

In August 2024 an unauthorized third party reached Halliburton's business applications and took information. The oilfield services company said it continued to provide its products and services to customers globally, and its finance chief said outages hit invoicing and collection. It reported $35 million of expenses, not a loss. RansomHub is linked only by press reports; Halliburton names no attacker.3,5,7,8

Timeline of the Halliburton incident

Every date is tied to a source. Press reporting appears only as evidence of what was said.

  1. Halliburton becomes aware that an unauthorized third party has gained access to certain of its systems.1
  2. Halliburton files a Form 8-K under Item 8.01, the general item. It activated its response plan with external advisors, is proactively taking certain systems offline and has notified law enforcement.1
  3. According to BleepingComputer, Halliburton emails suppliers a list of indicators of compromise.5
  4. BleepingComputer reports a partial RansomHub ransom note posted on a discussion site and identifies a file on Halliburton's list as a RansomHub encryptor. The same day, CISA, the FBI, MS-ISAC and HHS publish advisory AA24-242A on RansomHub. It names no victim.5,6
  5. Halliburton files a second 8-K, under Item 1.05 for material cybersecurity incidents: business applications disrupted, information exfiltrated, products and services continuing globally, and no material financial impact expected.3
  6. SEC staff write to Halliburton's chief financial officer asking why it filed under Item 1.05 and whether the incident is material.10
  7. Third quarter results and 10-Q: $35 million of incident expenses, and about $0.02 per share of lost or delayed revenue from the incident and Gulf of Mexico storms together. On the earnings call the finance chief says outages affected the ability to invoice and collect.7,8,9
  8. BleepingComputer headlines the figure as a "$35 million loss after ransomware attack."11
  9. Halliburton answers SEC staff in writing: the incident became material as additional facts emerged, judged on the totality of quantitative and qualitative factors.12
  10. SEC staff write that they have completed their review of the filing.13
  11. The FY2024 10-K describes the incident as "a material event" and gives $35 million of incident expenses for the full year, the same as the third quarter.4

Key facts and their status

Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.

QuestionWhat the record saysStatus
What systems were reached?Business applications supporting "aspects of the Company's operations and corporate functions"3Verified
Did Halliburton keep serving customers?The company says it "continues to provide its products and services to customers globally"3Verified (company statement)
Were field or control systems reached?No filing says so. "Industrial control" appears in no Halliburton filing from August 2024 to September 20262Verified (time-bound)
Was information taken?Yes: "accessed and exfiltrated"3Verified
What information, and whose?Not disclosedUndisclosed
How did the intruder get in?Not disclosed in any filing or government documentUndisclosed
Who was behind it?Halliburton names no actor. RansomHub, through a partial ransom note as reported by BleepingComputer5Reported only
Was ransomware involved?A journalist identified a file as a RansomHub encryptor; "ransomware" appears in no Halliburton filing since August 20242,5Reported only
Incident expenses$35 million, Q3 2024 and full year 2024; expenses, not a loss4,8Verified
Earnings effectAbout $0.02 per share of lost or delayed revenue, blended with Gulf of Mexico storms9Verified (blended)
Was the incident material?Halliburton determined it was material, while saying the financial impact was not3,4,12Verified
Did the SEC take action?Staff asked a question in writing and later completed their review. No enforcement action10,13Verified

Were Halliburton's oilfield operations shut down?

No filing says so; the company says it kept serving customers worldwide. Halliburton's first filing said it was taking certain systems offline and was "following its process-based safety standards for ongoing operations under the Halliburton Management System."1 Its second filing, under the material incident item, located the damage in business systems and, in the same document, described the field:

"The Company continues to provide its products and services to customers globally."
Halliburton Company, Form 8-K, Item 1.05, filed 3 September 20243

On the 7 November 2024 earnings call, chief executive Jeff Miller said: "Our employees maintained operational continuity under challenging conditions."7 A search of every Halliburton filing from August 2024 to September 2026 finds no use of "industrial control," and "operational technology" only in a generic proxy statement sentence about attacks in general.2 No filing says a field system was reached.

Two limits apply. "Continues to provide its products and services" is the company's own statement, not an independent measure, and "lost or delayed revenue" implies some work may have slipped; whether any individual job was late is undisclosed.9

What did the Halliburton incident actually disrupt?

On the record, what stopped was the invoice. The 3 September filing describes "disruptions and limitation of access to portions of the Company's business applications supporting aspects of the Company's operations and corporate functions."3 On the earnings call, the finance chief was specific:

"Our free cash flow was impacted by system outages, which affected our ability to invoice and collect receivables during the quarter. We work closely with our customers and expect to collect those amounts in Q4."
Eric Carre, Chief Financial Officer, Halliburton, third quarter 2024 earnings call, 7 November 2024 (third-party transcript)7

Miller said the event "had an impact on our free cash flow during the quarter due to delayed billing and collections and caused us to pause our share repurchase program."7 The pause was not a quarter without buybacks: the results release reports about $200 million repurchased in the third quarter.9

BleepingComputer reported that customers "couldn't generate invoices or purchase orders" and that some customers disconnected from Halliburton for lack of information.5 That is press reporting of administrative friction and precaution; it is in no filing. The one disconnection the primary record documents is Halliburton's own: "proactively taking certain systems offline."1

Was Halliburton hit by RansomHub ransomware?

RansomHub is a claim as reported, not a finding. Halliburton names no actor, and neither "ransomware" nor "RansomHub" appears in any of its filings since August 2024.2 The link rests on BleepingComputer's report of 29 August 2024: a partial RansomHub ransom note posted on a discussion site, and the outlet's identification of a file, "maintenance.exe," in Halliburton's supplier indicator list as a RansomHub encryptor. Halliburton told the outlet it was "not commenting beyond what was included in our filing."5

Advisory AA24-242A, published by CISA, the FBI, MS-ISAC and HHS the same day, is routinely cited as corroboration. It counts "at least 210 victims" across sectors including water and wastewater, information technology, healthcare, financial services, critical manufacturing, transportation and communications. It names no victim, and energy is not among the sectors it lists.6 Same-day publication is adjacency, not attribution. No leak-site listing for Halliburton was found in our review as of September 2026.

How much did the Halliburton incident cost?

Halliburton reported $35 million of expenses, not a loss, and has not separated the earnings effect from Gulf of Mexico storms. The third quarter 10-Q says:

"we incurred $35 million in expenses during the three months ended September 30, 2024 related to the engagement of external advisors to assess and remediate the effects of the activity, and restore our systems, as well as legal fees, payroll related costs, and other expenses."
Halliburton Company, Form 10-Q, Note 2, Impairments and Other Charges, 7 November 20248

The FY2024 10-K gives the same $35 million for the full year, consistent with the finance chief's statement on the call that "In Q4, we do not expect to incur significant further expenses related to the event."4,7 Separately, the results release says: "We experienced a $0.02 per share impact to our adjusted earnings from lost or delayed revenue due to the August cybersecurity event and storms in the Gulf of Mexico."9 The two causes are blended and never separated, so no part of the two cents can be attributed to the incident alone.

Why did the SEC question Halliburton's materiality filing?

Because Halliburton used the material incident item while saying the financial effect was not material, and SEC staff asked which it was. The 3 September 8-K was filed under Item 1.05, yet stated that "the incident has not had, and is not reasonably likely to have, a material impact on the Company's financial condition or results of operations."3 On 17 October 2024 staff wrote:

"Please advise us why you filed under Item 1.05 and tell us whether or not this incident is a material cybersecurity incident."
SEC Division of Corporation Finance, letter to Halliburton's Chief Financial Officer, 17 October 202410

Staff also asked "to what extent you considered qualitative factors in your materiality analysis and not just potential impact on financial condition and results of operations."10 Halliburton answered on 15 November 2024 that it "filed under Item 1.05 because it concluded that the cybersecurity incident had become material due to the discovery of additional facts after the Company initially disclosed preliminary details."12

"The Company weighed a number of quantitative and qualitative factors, none of which was necessarily material on a stand-alone basis."
Eric J. Carre, Chief Financial Officer, Halliburton, letter to SEC staff, 15 November 202412

The qualitative factors it named as significant included "the outage of the Company's critical business systems and applications, which impacted aspects of the Company's operations and corporate functions" and "the nature and scope of information the threat actor appeared to have exfiltrated," with the determination based on "the totality of the facts and circumstances."12 In our words rather than Halliburton's: material, but not on the money alone. On 3 December 2024 staff wrote, "We have completed our review of your filing."13 The letter was a question, not an enforcement action or a finding that the filing was wrong.

What is still not known about Halliburton

  • How the intruder got in. No filing or government document states the initial access vector.
  • Which systems were taken offline, and for how long.1,3
  • What information was taken, and whose. The company said information was "accessed and exfiltrated" but has not described it.3
  • Who carried it out. Halliburton names no actor, and no government document names one for this incident; RansomHub rests on a reported ransom note and a file identification.5,6
  • How much of the $0.02 per share of lost or delayed revenue came from the incident rather than Gulf of Mexico storms.9
  • Whether any field job was late, and what customers did in response, beyond press reports.
  • Why the field kept working. The record shows that it did, by the company's account; it does not show how.

Claims about Halliburton the record does not support

Widely repeated claimWhat the record says
"Halliburton reports $35 million loss after ransomware attack."The 10-Q reports $35 million of expenses for advisors, restoring systems, legal fees and payroll related costs, not a loss. No Halliburton filing uses the word "ransomware."2,8,11

BlastWave analysis: the invoice stopped, the oilfield did not

Analysis, not a disclosed fact

Halliburton is in this volume as a counter-example. Everything on its record is corporate: business applications disrupted, information taken, and, in the same filing, products and services continuing globally.3 Its finance chief located the damage in the ability to invoice and collect.7 On the consequence ladder this is an IT compromise with no physical operation halted on the record, one rung below IT compromise halting physical operations. The company disclosed within two days, moved to the material incident item within two weeks, kept serving customers, answered the regulator in writing, and its chief executive named preparedness as the lesson. It acted well.

The record shows the field kept serving customers; it does not show how. BlastWave's reading, which is analysis and not a disclosed fact, is that the systems that gate field work did not wait on the systems that went down. That is the fallback this volume keeps asking about, and here, as in a few other entries, it seems to have held. The lesson is to make it a design property rather than a result.

How BlastWave removes the paths an attacker uses to reach OT

Listen and watch

Podcast: “The Front Desk” (9:22). Joe Baxter and Cam Cullen on why, on the record, the billing stopped and the field kept working.

Video: Halliburton Short (60 to 90 seconds).

Frequently asked questions

What happened in the Halliburton cyberattack?

On 21 August 2024 Halliburton became aware that an unauthorized third party had gained access to certain of its systems. In 8-K filings of 23 August and 3 September 2024 it said it took certain systems offline, that portions of its business applications were disrupted and information was exfiltrated, and that it continued to provide its products and services to customers globally.

Were Halliburton's oilfield operations shut down by the attack?

No Halliburton filing says field operations were halted. The company's 3 September 2024 filing says it continued to provide its products and services to customers globally, and its chief executive said on the 7 November 2024 call that employees maintained operational continuity. That is the company's own account; whether individual jobs were delayed has not been disclosed.

Was Halliburton attacked by RansomHub?

Halliburton has never named an attacker, and the word ransomware appears in none of its filings. BleepingComputer reported on 29 August 2024 a partial RansomHub ransom note and identified a file as a RansomHub encryptor. The CISA and FBI RansomHub advisory published the same day names no victim, so RansomHub remains a claim as reported, not a finding.

How much did the cyberattack cost Halliburton?

Halliburton's 10-Q of 7 November 2024 reports $35 million of expenses for external advisors, restoring systems, legal fees and payroll related costs, and its FY2024 10-K gives the same figure for the full year. That is expenses, not a loss. The company also cited about $0.02 per share of lost or delayed revenue, blended with Gulf of Mexico storms and never separated.

Why did the SEC send Halliburton a letter about the incident?

Halliburton filed under Item 1.05, the item for material cybersecurity incidents, while saying the financial impact was not material. On 17 October 2024 SEC staff asked why it used Item 1.05 and whether the incident was material. Halliburton answered on 15 November 2024, and staff wrote on 3 December 2024 that they had completed their review. It was a question, not an enforcement action.

Why did Halliburton say the incident was material?

In its 15 November 2024 letter to SEC staff, Halliburton said the incident became material as additional facts emerged. It weighed quantitative and qualitative factors, none necessarily material on its own, and judged the totality. The qualitative factors it named included the outage of critical business systems and applications and the nature and scope of the information taken.

What did the Halliburton incident actually disrupt?

Halliburton's 3 September 2024 filing describes disruption to portions of its business applications. On the 7 November 2024 earnings call, the chief financial officer said system outages affected the company's ability to invoice and collect receivables during the quarter, amounts it expected to collect in the fourth quarter. The chief executive said the event also caused a pause in share repurchases.

StrykerThe mirror: a similar intrusion into corporate systems, at a manufacturer that could not make product for almost three weeks.Colonial PipelineThe opposite decision in the same sector: after a business-network compromise, the operator itself stopped the physical process as containment.CPC Corporation TaiwanThe billing-end pair: an energy company whose payment systems failed while, by its own account, supply continued.

Sources

Primary sources are Halliburton's own SEC filings, its correspondence with SEC staff and the federal RansomHub advisory. Earnings call wording comes from third-party transcripts, and press is cited only as evidence of what was said or reported.

  1. Company filingHalliburton Company, Form 8-K, Item 8.01, dated 21 August 2024, filed 23 August 2024 (accession 0000045012-24-000049): "became aware that an unauthorized third party gained access to certain of its systems"; "proactively taking certain systems offline to help protect them and notifying law enforcement." sec.gov
  2. Company filingSEC EDGAR, Halliburton Company record (CIK 0000045012, SIC 1389, oil and gas field services) and full-text search of its filings from 1 August 2024, run 24 September 2026: "ransomware," 0 results; "RansomHub," 0; "industrial control," 0; "operational technology," 3, all a generic sentence in proxy statements; "business applications," 4.
  3. Company filingHalliburton Company, Form 8-K, Item 1.05, dated 30 August 2024, filed 3 September 2024 (accession 0000045012-24-000052): business applications disrupted, information "accessed and exfiltrated," products and services continued globally, no material financial impact expected. sec.gov
  4. Company filingHalliburton Company, Form 10-K for fiscal year 2024, filed 12 February 2025 (accession 0000045012-25-000010): Items 1, 1(a) and 1(c), and Note 2, Impairments and Other Charges (full-year incident expenses of $35 million). sec.gov
  5. PressLawrence Abrams, BleepingComputer, "Halliburton cyberattack linked to RansomHub ransomware gang," 29 August 2024. Cited as evidence of what was reported. bleepingcomputer.com
  6. FederalCISA, FBI, MS-ISAC and HHS, Joint Cybersecurity Advisory AA24-242A, "#StopRansomware: RansomHub Ransomware," 29 August 2024. Names no victim; energy is not among the sectors listed. PDF (IC3) · cisa.gov
  7. PressHalliburton third quarter 2024 earnings call, 7 November 2024, as transcribed by The Motley Fool and cross-checked against an independent transcript. Third-party transcripts, not a Halliburton-published transcript. Cited as the record of what was said on the call. fool.com
  8. Company filingHalliburton Company, Form 10-Q for the quarter ended 30 September 2024, filed 7 November 2024 (accession 0000045012-24-000063), Note 2, Impairments and Other Charges. sec.gov
  9. Company filingHalliburton Company, Form 8-K, Items 2.02 and 7.01, Exhibit 99.1, third quarter 2024 results, 7 November 2024 (accession 0000045012-24-000061): the $0.02 per share statement attributed to chief executive Jeff Miller, and Q3 share repurchases of about $200 million. sec.gov
  10. RegulatorUS Securities and Exchange Commission, Division of Corporation Finance, staff comment letter to Eric Carre, Chief Financial Officer, Halliburton Company, regarding the Form 8-K filed 3 September 2024, dated 17 October 2024 (EDGAR UPLOAD, 0000000000-24-011681). sec.gov
  11. PressBill Toulas, BleepingComputer, "Halliburton reports $35 million loss after ransomware attack," 11 November 2024. Cited as evidence of what was said. bleepingcomputer.com
  12. Company filingHalliburton Company, CORRESP, letter of Eric J. Carre, Executive Vice President and Chief Financial Officer, to SEC staff, 15 November 2024 (accession 0000045012-24-000067). sec.gov
  13. RegulatorUS Securities and Exchange Commission, Division of Corporation Finance, letter to Eric Carre, 3 December 2024 (EDGAR UPLOAD, 0000000000-24-013335): "We have completed our review of your filing." sec.gov

Cite this page

BlastWave. “Halliburton Cybersecurity Incident (2024): What Is Verified.” Hackopedia, Volume 2, FILE 034. Last verified 28 September 2026. https://hackopedia.blastwave.com/oil-and-gas/halliburton-2024/

Revision history

DateChange
6 Oct 2026Numbered FILE 034 in Hackopedia Volume 2, in the Oil and Gas edition.
28 Sep 2026Hand-check of the FY2024 annual report confirmed that $35 million of incident expenses is also the full-year figure. Cross-entry consistency review.
26 Sep 2026Full validation of every figure, date and quotation against Halliburton's SEC filings, the SEC correspondence, the federal advisory and the earnings call transcripts. Framing aligned with other entries that record fallbacks that held.
25 Sep 2026Independent second verification of the filings, SEC letters and contemporaneous reporting. Materiality wording aligned exactly to Halliburton's letter, and the share repurchase pause qualified by the roughly $200 million repurchased in the quarter.
24 Sep 2026Volume 2 entry built from primary sources.

How Hackopedia verifies an entry

Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry