reported cyberattack Public report: Date confidence: Medium

Ciberataque reportado contra el sistema administrativo de PDVSA con impacto operativo en disputa

El ciberataque contra el sistema administrativo de PDVSA fue comunicado el 15 de diciembre de 2025 por la empresa, que afirmó haberlo detectado y neutralizado. Según su versión, buscaba afectar su operatividad, pero quedó limitado al sistema administrativo sin impacto en áreas operativas, suministro o exportaciones. Varios medios citaron fuentes que describieron sistemas fuera de línea, trabajo manual y demoras o suspensión temporal de coordinación de cargamentos. La atribución oficial a Estados Unidos carece de evidencia pública independiente. Investigaciones publicadas en abril de 2026 documentaron el wiper Lotus contra organizaciones venezolanas de energía y servicios públicos, pero declararon expresamente que no existe prueba de que Lotus se utilizara en este incidente de PDVSA.

Overview

Missing evidence

informe técnico, indicadores, causa y vector del incidente PDVSAalcance/duración verificables del sistema administrativo afectadoevidencia independiente para atribución a Estados Unidosconfirmación documental de demoras o suspensión de cargamentosevidencia que vincule Lotus u otro malware con PDVSA

Impact details

PDVSA confirmó afectación limitada a su sistema administrativo y negó impacto en áreas operativas, suministro o exportaciones. Fuentes citadas por medios describieron sistemas fuera de línea, trabajo manual y demoras/suspensión de coordinación de cargamentos; sin artefactos públicos, duración o alcance verificable, el impacto operativo queda en disputa. No existe prueba de wiper, ransomware o pérdida destructiva. La interrupción o continuidad del servicio no quedó establecida; la disponibilidad se conserva como desconocida.

sistema administrativo según PDVSA

Classification & severity

Category
Undetermined
Subtype
reported cyberattack
Confidence
Medium

La víctima confirmó un ciberataque al sistema administrativo, pero no publicó artefactos, vector o familia de malware; la investigación Lotus declara que no existe prueba de vínculo con PDVSA.

Severity assessment

Affected scope
Organization-wide
Public confidence
Moderate

La víctima confirma afectación administrativa pero niega afectación operativa; fuentes de medios la contradicen. Sin telemetría, duración, pérdida o vínculo con malware, la severidad no puede fijarse.

Timeline

Disclosure

PDVSA informó que detectó y neutralizó un ciberataque limitado a su sistema administrativo, sin afectación operativa según la empresa.

Publication

The Record y otros medios publicaron el 16 de diciembre versiones de fuentes que describían sistemas fuera de línea, trabajo manual y demoras o suspensión de coordinación de cargamentos, en conflicto con PDVSA. Reuters ya había publicado esas versiones contrapuestas el 15 de diciembre.

Evidence & sources

9 sources
Contradiction Security research Source confidence: High

What this source supports

  • Kaspersky documented Lotus Wiper activity against Venezuelan energy and utility organizations
  • the article explicitly states there is no proof Lotus Wiper was used in the PDVSA incident
  • actor identity remains unknown

Evidence limits

Authoritative secondary coverage of Kaspersky research, but expressly not evidence that Lotus affected PDVSA.

Relevance to this case

Materially contradicts the inherited title/classification linking PDVSA to Lotus.

Contradiction Security research Source confidence: High

What this source supports

  • Kaspersky documented Lotus Wiper against unspecified Venezuelan energy and utility organizations
  • the reporting does not establish PDVSA as a Lotus victim

Evidence limits

The article identifies the sector/country campaign, not this PDVSA event.

Relevance to this case

Context only and insufficient for malware attribution to PDVSA.

Corroborating Media report Source confidence: Medium

What this source supports

  • PDVSA publicly reported a cyberattack affecting its administrative system
  • PDVSA attributed it to the United States without public technical evidence
  • PDVSA said operational areas were unaffected

Evidence limits

Reports the company statement; does not independently validate cause, attacker or technical scope.

Relevance to this case

Same-day coverage of PDVSA’s official disclosure.

What this source supports

  • PDVSA confirmed an administrative-system cyberattack and claimed operational continuity
  • Reuters sources reported systems offline, manual work and suspended cargo deliveries
  • no public evidence linked the event to the United States

Evidence limits

The operational-impact assertions are attributed to unnamed Reuters sources and conflict with PDVSA.

Relevance to this case

Directly documents the competing official and media accounts.

Impact Media report Source confidence: Medium

What this source supports

  • PDVSA said only administrative systems were affected and operations continued
  • Bloomberg/Reuters reporting described precautionary shutdowns and export disruption

Evidence limits

Derivative reporting; the extent and duration of operational disruption remain disputed.

Relevance to this case

Corroborates that conflicting impact accounts circulated.

Corroborating Media report Source confidence: Medium

What this source supports

  • the article embeds an exact Con el Mazo Dando X post reproducing PDVSA's statement
  • the embedded statement says administrative-system impact but no operational-area impact

Evidence limits

The outlet repeats the official narrative and does not independently establish attribution or technical cause.

Relevance to this case

Preserves the exact social-media reproduction of the PDVSA statement.

Context Security research Source confidence: Medium

What this source supports

  • the living roundup summarizes the official no-operational-impact claim and external reports of administrative/export disruption

Evidence limits

It is secondary synthesis, not ransomware proof; it neither establishes ransomware nor Lotus.

Relevance to this case

Context for the conflicting impact accounts only.

PDVSA: comunicado sobre ataque cibernético

Petróleos de Venezuela, S.A. (PDVSA) Dec 15, 2025
Primary Official statement Source confidence: High

What this source supports

  • PDVSA says it was the object of a cyberattack aimed at its operations
  • PDVSA says it detected and neutralized the attempt
  • PDVSA says impact was limited to its administrative system and operational areas/supply/export commitments continued
  • PDVSA attributes the event to the United States

Evidence limits

Authoritative for what PDVSA reported, not independent proof of attacker, cause or complete impact.

Relevance to this case

Primary victim statement for event existence and official scope.

Con el Mazo Dando reproduce el comunicado de PDVSA

Con el Mazo Dando / X Dec 15, 2025
Corroborating Social media Source confidence: High

What this source supports

  • the exact rendered post says PDVSA reported a cyberattack aimed at stopping operations
  • its sole media item visibly reproduces the full PDVSA communiqué

Evidence limits

This is faithful publication of the official statement, not independent technical corroboration.

Relevance to this case

Exact social artifact embedded by an attached source.