Rosneft Deutschland reported the incident in the early hours of Saturday morning, the BSI said.
Anonymous had published a statement on Friday claiming responsibility for the attack and saying it had captured 20 terabytes of data.
Prosecutors in Berlin have opened an investigation, according to a report in Der Spiegel magazine.
Rosneft Deutschland reportedly subsequently took its systems offline. Its pipelines and refineries continue to operate as normal, the report added.
The BSI had warned in early March of a heightened risk of cyberattacks and an “increased threat situation for Germany” after Russia’s invasion of Ukraine, advising businesses to increase IT security measures.
It has now issued a new cybersecurity warning to other companies in the oil industry.
Rosneft Deutschland says it has been responsible for around a quarter of all crude oil imports to Germany in recent years and has stakes in three
refineries in the country.
Rosneft chief executive Igor Sechin is a close ally of Russian President Vladimir Putin.
Former German Chancellor Gerhard Schröder is chairman of the board of directors, a role that has seen him receive heavy criticism in recent weeks.
The Anonymous hacker group has claimed responsibility for cyberattacks on several Russian institutions since the start of the conflict in Ukraine, including the Kremlin itself, the defence ministry, the Duma lower house of parliament and pro-Kremlin Russian media.
Anonymous said it “didn’t want to mess around directly with the Russian energy companies… because there are some sanctioning states whose energy supply is linked to Russia”.
“But Rosneft Germany is interesting enough,” it added.