Event description
Following a major cyberattack, Tube, a leading oil and gas company, was forced to shut down its gas pumping station.
The attackers' plan was rather sophisticated: they targeted the system that supplies process gas for dry gas seals, which are critical elements of the gas pumping station’s centrifugal compressor. The main function of the seals is to prevent gas leaks through the gaps between the rotating shaft and the compressor casing.
For dry gas seals to operate properly, purified process gas is required, which is supplied under pressure to create a protective barrier. The hackers shut off the seal gas supply valve, causing untreated gas to leak from the compressor.
The operators didn’t immediately notice that the process parameters had changed, which allowed the attack to develop. The seals got contaminated and wore out quickly, requiring a complete replacement. As a result, the gas pumping station was shut down for a lengthy repair, which led to a sharp decrease in gas supplies. Tube quickly switched to backup facilities, reducing its reliance on the compromised industrial control system. However, the consequences of the attack have already resulted in significant financial losses for the company.
Experts unanimously describe the attack as a perfectly planned operation: the adversaries not only exploited vulnerabilities in the industrial software but also demonstrated a deep understanding of the industrial process.
Consequences
1. Damage to company property
2. Enterprise disruptions and downtime
3. Financial damage
This has happened before
The Record
Russian hacktivist threat on Canada’s pipelines is "call to action," top cyber official says
A cybersecurity incident affecting a Canadian gas pipeline was revealed in a trove of leaked U.S. intelligence materials that included an apparently intercepted conversation between a hacking group known as Zarya and an officer at Russia’s Federal Security Service (FSB). According to the document, marked Top Secret, during this conversation the hackers claimed they could "increase valve pressure, disable alarms, and initiate an emergency shutdown of an unspecified gas distribution station" located in Canada.