Zephyr Energy loses £700K in cyber hit that rerouted contractor payment

Attackers slipped into the process and redirected funds, leaving the company scrambling to recover the cash

UK-listed oil and gas outfit Zephyr Energy plc has admitted a cyber incident siphoned off roughly £700,000 after a single payment to a contractor was quietly redirected to an attacker-controlled account.

The company, a technology-led oil and gas firm focused on developing assets in the US Rocky Mountain region, said on Thursday that one of its American subsidiaries was targeted in what it described as a "highly sophisticated" attack.

The result was the diversion of funds during what should have been a routine payment process, with the cash ending up in a third-party account before anyone realized something was off.

Zephyr isn't saying how the attackers pulled it off, but the outline is familiar: a legitimate payment, stealthily rerouted so the money ends up somewhere else entirely.

The London-headquartered biz says it moved quickly once the issue was spotted, notifying law enforcement and working with banks and external consultants to try to claw the money back. Whether any of that £700K makes a return trip remains unanswered as these cases tend to become a race against time once funds start hopping between accounts.

Zephyr is also drawing a fairly clear boundary around what this incident is and what it isn't. The company says its systems have been reviewed by external consultants, the issue has been contained, and day-to-day operations have not been disrupted.

There is, however, the usual nod to "industry standard practices," followed by the promise that extra layers of security have now been added. What those layers look like has not been disclosed, but in cases like this, they often boil down to tighter payment verification, stronger controls around supplier bank detail changes, and a renewed appreciation for picking up the phone before sending large sums of money into the void.

For investors, Zephyr is at pains to underline that this is a contained hit. The board says the company has more than enough working capital to absorb the loss without affecting ongoing operations.

Still, it's a pricey reminder that in 2026, you don't need to break into a network to make off with the cash. Sometimes it's enough to wait for finance to hit "send." ®