Skip to content
Cyber Threat
CTI Academy Sponsor CTI Academy
Ransomware victim Energy & Utilities

IGPL

Listed by Hyflock on · organisation based in Nigeria

igpetro.com

Disclosed
Oct 13, 2026
Leak-site listing date
Threat group
Hyflock
8 victims listed
Country
Nigeria
#61 most targeted
Sector
Energy & Utilities

ThreatAI analysis

Compiled from this incident record and the threat intelligence profile for Hyflock. Figures and technique mappings are quoted from the source data, not inferred.

IGPL, India's largest single-site Phthalic Anhydride producer, was listed on Hyflock’s dark web leak site on October 13, 2026. The company primarily manufactures and exports products like phthalic anhydride to the global market.

About IGPL

Company Profile & Core Business • Overview: Established in 1988 and headquartered in Mumbai, India, IGPL operates its core manufacturing facility within the Taloja chemical industrial corridor in Maharashtra. The company is a publicly traded, international petrochemical products manufacturer listed on both the National Stock Exchange of India (NSE) and the Bombay Stock Exchange (BSE). • Core Products: The company primarily specializes in the production of Phthalic Anhydride (PAN). Leveraging economies of scale, it also recovers valuable by-products such as Maleic Anhydride and Benzoic Acid, and further extends its downstream value chain to manufacture plasticizers like Di-Ethyl Phthalate (DEP). Industry Influence • Market Dominance: IGPL stands as India's largest single-site Phthalic Anhydride (PAN) producer, commanding a massive domestic market share of approximately 50%. Its Taloja complex is also recognized as one of the largest single-location PAN manufacturing facilities globally, boasting an annual production capacity of 270,000 Metric Tonnes Per Annum (MTPA). • Critical Supply Chain Link: Phthalic Anhydride serves as an indispensable chemical intermediate in the industrial value chain. IGPL's products are widely supplied to leading global and domestic manufacturers across dozens of backbone industries, including paints, coatings, plastics, flexible PVC, unsaturated polyester resins (UPR), automotive components, construction chemicals, and fragrances. Beyond dominating the Indian market, the company exports to international markets, exerting a strong global supply chain presence. Financial Performance & Annual Revenue According to the latest financial disclosures: • Annual Revenue: IGPL's annual total revenue consistently ranges between INR 20.7 billion and INR 22.3 billion (approximately USD 210 million to USD 270 million). • Recent Revenue Trends: As of 2026, its trailing twelve months (TTM) rolling total revenue sits at approximately INR 20.73 billion (around USD 247 million). The company's top-line performance exhibits cyclical patterns, highly influenced by fluctuations in international chemical raw material prices (specifically Orthoxylene) and global supply chain demand. • Profitability: The company has maintained a net profit margin of around 3.94% over the past 12 months, with its current market capitalization valued between INR 17.4 billion and INR 17.6 billion.

Source record: ransomware.live

About the Hyflock group

Hyflock has listed 8 victims since September 2026.

Incident analysis

IGPL was listed by Hyflock ransomware, a group with 8 victims recorded in this database. The listing appeared on the group's leak site on October 13, 2026.

IGPL is based in Nigeria and operates in the Energy & Utilities sector. Nigeria ranks #61 worldwide for ransomware disclosures, with 22 victims in this database.

Sector context. Organisations in this sector hold valuable data and operational systems that ransomware groups seek to exploit for financial gain through encryption and data exfiltration.

Hyflock typically follows a double extortion model: data is exfiltrated from the victim's systems before files are encrypted, so the victim faces two demands at once — pay to restore access, and pay to keep stolen data unpublished. The leak site, where this listing appeared, is the lever for the second demand.

Source. Public leak-site disclosures aggregated via the ransomware.live API. The disclosure date is when the listing was published, which can differ from the date of compromise. This site does not publish or link to stolen data. Last updated .

Frequently asked questions

Was IGPL attacked by ransomware?

Yes. IGPL was listed as a victim of the Hyflock ransomware group on October 13, 2026. The organisation is based in Nigeria and operates in the Energy & Utilities sector. The disclosure appeared on the group's dark web leak site.

Which ransomware group attacked IGPL?

IGPL was attacked by Hyflock ransomware. Hyflock is one of the most active ransomware groups, having claimed 8 victims globally. The group typically employs a double-extortion model: encrypting the victim's files and threatening to publish stolen data.

When did the IGPL ransomware attack occur?

The ransomware attack on IGPL was disclosed on October 13, 2026. This date reflects when the victim was published on the threat group's leak site, which may differ from the actual date of initial compromise.

What data was stolen in the IGPL ransomware attack?

The specific data stolen from IGPL has not been independently verified by this platform. Ransomware groups typically exfiltrate data before encrypting systems and use the threat of publication to pressure victims. As a Energy & Utilities organisation, IGPL likely held sensitive business data, client information, and operational records.

How can organisations protect against Hyflock attacks?

To defend against Hyflock and similar threat actors, organisations should: maintain regular offline backups tested for restoration; implement network segmentation to limit lateral movement; deploy multi-factor authentication on all remote access; use endpoint detection and response (EDR) tools; conduct regular phishing and security awareness training; and monitor threat intelligence feeds for indicators of compromise (IOCs) associated with active groups.