It has been reported that two companies involved in storing and supplying oil and other materials said Tuesday they have been hit by a cyberattack that has impacted operations in Germany. Oiltanking GmbH Group and Mabanaft Group on Saturday discovered what they called a “cyber incident affecting our IT systems” and launched an investigation together with external specialists, the companies said in an emailed statement. They did not elaborate on the nature of the incident or address who might be responsible, and said they are working to understand its “full scope.” They said that Oiltanking GmbH Group — which operates storage tank terminals for oil, gas and chemicals — is still operating all terminals in all global markets. But facilities at Oiltanking Deutschland GmbH, a separate entity that operates all terminals in Germany and is part of Mabanaft, are “operating with limited capacity.”
Commenting on this, Greg Day, Vice President, Global Field CSO at Cybereason, said “Fuel prices continue to rise, in part because of supply chain complexities, Covid and world affairs. Today's confirmed cyberattacks on German oil suppliers Oiltanking GmbH Group and Mabanaft Group seem fortuitous to say the least. It's promising to see that their systems were segmented as only subsidiaries have been impacted. At this stage, what is most important is how quickly Oiltanking GmbH and Mabanaft recover and return to 100 percent operational capacity. That means understanding what and how to ensure another attack isn't repeated. Too often, organisations pay a ransom and get hit a second time. In fact, Cybereason found that 80 percent of organisations that participated in a global ransomware study that paid a ransom in 2021 were hit a second time. Organisations with rich data that spans across all the systems that were compromised and others that could have been impacted by those compromised systems have an advantage in the fight against ransomware gangs. All too often we see businesses struggling to maintain forensic data and/or they lack the internal skill set and capabilities to correlate data into tangible actions required to provide businesses with digital operational resilience that will put an end to the ransomware scourge.”
Subscribe to PII and receive:
Our long-established bi-monthly digital magazine *Process Industry Informer*, featuring exclusive articles, news and updates across the Process Industries, plus commentary from our three industry experts:
Sean Moran
Gavin Smith
Dave Green
PLUS:
- Process Industry Update — our weekly e-newsletter
- PII Podcast
- Special messages from our advertising partners
Stanislav Sivak, Associate Managing Software Security Consultant at the Synopsys Software Integrity Group, added “While there isn’t much information available on the motivation, impact, and attack vector so far, it is interesting to see that even some not so publicly known organisations such as petrol distributors are getting attention from cyber-attackers nowadays. Then again, this is the case for all critical infrastructure elements – you don’t notice they exist, until they don’t. This is a perfect example of how software risk equates to business risk. Fortunately, in this instance, either due to other compensating controls or the breadth of the attack, the impact is limited to a partial Denial-of-Service and it seems that no data breach has occurred. Some informational sources on the Internet indicate that a ransomware attack could be the root incident. Having alternative independent operational options, such as paying by cash rather than by card, proves to be a good temporary solution. However, an up-to-date and simulated disaster recovery plan will help restore the necessary level of operations and prioritise next steps.”
