Energy is a hot sector to be attacking, so that is points in your favor, but unless it's some extension of Russian military/Wagner I'm not sure white supremacists make sense. It really doesn't make sense that they would contact you unless it's ransomware.

Frankly the question I'm asking myself most right now is "is this some kind of phishing?" followed by "is this schizophrenia?"

A CEO or CTO might prefer denial. If you want to pursue that route, then perhaps find a CISO or head of security of some sort, perhaps an administrator in IT. Were I in those positions I would definitely want to at least perform a few sanity checks. Politics can be awful if you don't have competent people around you. A competent security person would definitely be concerned about compromised employees. Corporate environments are likely to punish someone for coming forward greatly disincentivizing that behavior while sane companies would be happy someone took responsibility and came to them despite the risks of getting blamed.

Mandiant and Crowdstrike are two entities you might consider, they are big and corporate, so hard to know how that would turn out.

https://www.mandiant.com/contact-us

https://www.crowdstrike.com/services/experienced-a-breach/

You could try to send e-mails to individuals, either people who have given talks at security conferences or people in local colleges.

You could try people working in journalism, they might have contacts or an idea.

You might try to mail your local represenatives, at least in the us a rep can expedite your requests.

You might try to see if you can find names related to the colonial pipeline attack: https://en.wikipedia.org/wiki/Colonial_Pipeline_ransomware_a... and directly contact them.

I doubt the FBI would be much different, but you could try them too. Unfortunately, I suspect many of those things are responses to actual damage caused. For every person dealing with problems like yourself, there are probably 10 companies dealing for the same problem. That requires prioritization.

The real problem is that from a technical perspective, I would assess your situation as most likely explained by a successful phishing attack resulting in ransomware placement. Nobody institutional is interested in looking into or investigating problems like that, particularly in absence of real realized damages.

You will either have to pay money or mine your personal network to get something technically compelling.

New phones, new devices, new password manager, new passwords, etc is probably the most sane approach to your problem.

> All of our devices have been hacked and are being monitored, but I don't have the ability to prove this.

From a technical perspective you need to provide more info. If you don't have the ability to prove it, I don't think you have the ability to affirmatively say you've been hacked and are being monitored. If you can prove you are hacked or are being monitored, then you still have to prove you were an explicit target rather than a target of opportunity (opportunity meaning you got phished or got a Trojan by some automated system).

It's also important to understand that to you this is a big deal because it's about you, but to the average security person, you're probably a 30 minute meeting on their calendar.

I haven't read anything so far that makes me think this isn't a "geek squad" problem.

It's common to phish people by sending them a known password (usually gotten from a password dump from a hacked website), or telling them a scary story. If one person's computer gets compromised, then the information in e-mail can become a vector for making more convincing phishing e-mails.

Just to give you a really good metaphor of what you're up against, it's like you think you have been poisoned with polonium and are trying to convince your doctor. Possible? Yes. Likely? no. Most likely diagnosis? Problem with patient, not polonium poisoning, maybe food poisoning.