German prosecutors have charged a 30-year-old man with carrying out a cyberattack on Rosneft Deutschland, the German subsidiary of Russia’s state-owned oil giant. The attack, launched in the weeks after Moscow’s full-scale invasion of Ukraine, incapacitated the company’s operations and caused millions of euros in damages.

The Prosecutor’s Office of Berlin said on Wednesday the suspect faces two counts of data espionage, including one charge of particularly serious computer sabotage. Investigators from the Federal Criminal Police Office (BKA) previously alleged he stole around 20 terabytes of data and deleted information from critical systems during the March 2022 intrusion. The hacker’s identity has not been disclosed.

The stolen data was later published on a website allegedly run by the accused together with two other members of the Anonymous hacking collective. The site, which included a partial list of files, went offline in mid-2023. 

Hackers identifying themselves as “Anonymous Germany” disclosed the breach in March 2022, claiming to have wiped information from dozens of devices, including 59 Apple systems, and to have embedded the slogan “Glory to Ukraine” in Rosneft’s infrastructure. Screenshots posted online suggested they had obtained administrator rights.

Prosecutors said the attack forced Rosneft Deutschland to shut down its IT systems and launch a forensic investigation, incurring follow-up costs of about €9.76 million (about $11.39 million). Internal communications and operations were severely disrupted for days, while delivery logistics were hampered, leading to additional economic losses of roughly €2.6 million (over $3 million), German prosecutors said.

At the time, Germany’s Federal Office for Information Security (BSI) warned the incident had limited the company’s ability to provide critical services.

Anonymous said its motivation was Rosneft’s close ties to Russian President Vladimir Putin and the company’s efforts to evade sanctions.