In a worrying trend, oil facilities in Germany, Belgium, and the Netherlands have all recently been affected by cyber-attacks.
Germany
The attack on German oil, vehicle fuel and petroleum products company Oiltanking Deutschland GmbH & Co. KG happened just over a week ago. However, some reports have suggested that the company’s systems were hit by ransomware, thereby seriously limiting capacity. Also, the German oil company ‘Mabanaft’ was the victim of an attack on its production systems.
Belgium
As in Germany, SEA-Invest terminals in Belgium, including its largest in Antwerp (called SEA-Tank), were hit by cyberattacks the day before the German attack. SEA-Invest’s European and African ports were also affected.
The Netherlands
The Netherlands-based gas and oil storage company Evos was also targeted, resulting in the breakdown of its IT services at its Terneuzen terminal, causing delays in operations.
Disruptive
Attacks on oil companies can be highly disruptive and costly. For example, American oil pipeline company Colonial Pipeline Co. was hit by a ransomware attack last April that resulted in Colonial paying hackers a $4.4 million ransom. The hackers are believed to have been a Russia-linked cybercrime group ‘DarkSide’ who also stole nearly 100GB of data in the attack. Investigations revealed that the attackers gained access using the login details of a VPN account that were part of a batch of leaked passwords on the dark web. The account didn’t use multifactor authentication, which meant that the hackers could breach the network using a compromised username and password!
Costly
For organizations such as oil companies, it typically costs between 650,000 and 1.5+ million euros to recover from a big ransomware attack.
Linked / Coincidence?
Although it has not yet been conclusively proven who was behind the attacks or whether they were linked, some commentators have noted that the timing, with Russia threatening to close its oil pipelines to Europe over the crisis in Ukraine, may be more than a coincidence. Some have also noted that with Germany being a major European consumer of Russian fuel, an attack of this kind could act as a way to pressure Germany.
What Does This Mean For Your Business?
The situation between Russia and Ukraine led to warnings last week that US and European businesses needed to prepare themselves for possible Russian-based cyber-attacks. Russia currently supplies around 35 per cent of the European Union’s natural gas. Germany bought the most and exported most of its crude oil to Europe. Therefore, it is perhaps not surprising that coupled with the threat of shutting off the gas pipeline, Russia could (if they were behind the attacks) apply more pressure and create massive disruption to multiple businesses along many supply chains in many different countries. One important thing about these and similar attacks (e.g., the Colonial Pipeline Co attack) is that it can take something as small as one set of stolen login details (and no 2FA) and an old account that hasn’t been shut down to cause untold damage to a business of any size. A chain is only as strong as its weakest link, and with more attacks likely, now would be a good time for companies and organizations to tighten up on basic security measures. A few steps are to remind staff of the threats and best practices (policy) to deal with them, e.g., have strong passwords changed regularly, no password sharing and ensuring nobody clicks on unknown links in emails, to name but a few.
