Event description

A cyberattack shut down Tube' gas processing plant. Preliminary investigations suggest that hackers allegedly linked to a well-known APT group gained access to the plant’s industrial control system (ICS).

The attack affected the operation of the absorption column, which removes acidic components from natural gas. This purification stage is crucial for the subsequent processing stages, including the production of methanol and ammonia.

It is believed that the hackers altered the column operation parameters, reducing the flow of the amine solution. As a result, the concentration of hydrogen sulfide in the purified gas exceeded allowable limits. The monitoring system detected critical parameter values, which triggered the automatic shutdown of all key installations at the plant.

The damage from the downtime is estimated to exceed $ 2.5 million. "It was a well-planned and a highly organized cyberattack. The hackers clearly knew where to strike," the plant’s managing director said.

Consequences

1. Enterprise closure
2. Financial damage

This has happened before

The Record

Russian hacktivist threat on Canada's pipelines is "call to action," top cyber official says

A cybersecurity incident affecting a Canadian gas pipeline was revealed in a trove of leaked U.S. intelligence materials that included an apparently intercepted conversation between a hacking group known as Zarya and an officer at Russia's Federal Security Service (FSB). According to the document, marked Top Secret, during this conversation the hackers claimed they could "increase valve pressure, disable alarms, and initiate an emergency shutdown of an unspecified gas distribution station" located in Canada.