Employees of Aberdeen-based engineering company Wood Group have had personal and financial information exposed in a cyberattack, prompting the company to notify current and former workers about the breach.
Letters sent to affected employees this week confirmed that the compromised information included full names, employee identification numbers, bank account numbers, bank sort codes and home addresses. The breach followed a hacking incident in October 2025 that is believed to have involved a Russian cybercrime group.
The incident was uncovered after an investigation into the attack, which affected multiple organisations worldwide. Wood said an unauthorised third party exploited a previously unknown software vulnerability in Oracle E-Business Suite, a platform used by businesses to manage employee and operational data.
Wood Offers Credit Monitoring to Affected Employees
In its notification letter, Wood advised affected individuals to use strong passwords, change them regularly and activate multi-factor authentication on financial accounts. Employees were also encouraged to monitor bank accounts and credit card statements for unusual transactions and remain alert to suspicious emails, text messages and phone calls.
Wood confirmed that it had secured the services of credit reference agency Equifax to provide credit score monitoring for those affected. However, one former employee who spoke to The Press and Journal expressed frustration, saying he was “really annoyed” that a year’s subscription to a credit monitoring service appeared to be the only compensation being offered.
A Wood spokesperson said the company identified the incident in October 2025 and temporarily contained the external threat actor’s access to a limited portion of its Oracle E-Business Suite environment.
Following an investigation involving cybersecurity specialists, Wood said the incident had been fully contained. The company reported no evidence of continuing malicious activity, disruption to its operations or impact on client project data and confidential client information.
The company also said it had found no evidence that the affected information had been misused or that anyone had attempted to misuse it.
Russian Cybercrime Group Linked to Wider Attacks
Cybersecurity company CrowdStrike previously reported attacks against several unnamed businesses in October 2025. It expressed moderate confidence that Russian e-crime group Graceful Spider was responsible, while acknowledging that multiple hacking groups could have been involved.
Wood said there was no evidence it had been specifically targeted and noted that hundreds of organisations worldwide were affected by the same software vulnerability.
The breach highlights the risks organisations face when cybercriminals exploit software flaws to access sensitive personal and financial information. Stolen data can potentially be used in phishing schemes, sold to other criminals or exploited in attempts to commit financial fraud.
The incident comes amid a series of high-profile cyberattacks affecting businesses and other organisations, reinforcing the importance of protecting employee and customer information and providing timely support when personal data is compromised.
