Event description

A sophisticated cyberattack shut down gas production at one of Tube’s key fields. According to a preliminary investigation, the attackers gained access to the industrial control system (ICS) and closed a well’s output valve, which caused gas extraction to stop immediately.

The incident had a knock-on effect: the shutdown of the well disrupted the pressure balance, leading to a cascading shutdown of the neighboring wells. This resulted in a shortage of raw materials and affected other process flows.

It will take Tube at least 48 hours to restore the normal operations and resume gas extraction, while its losses are already estimated to be millions of dollars.

Consequences

1. Enterprise closure
2. Financial damage

This has happened before

The Record

Russian hacktivist threat on Canada’s pipelines is "call to action," top cyber official says

A cybersecurity incident affecting a Canadian gas pipeline was revealed in a trove of leaked U.S. intelligence materials that included an apparently intercepted conversation between a hacking group known as Zarya and an officer at Russia's Federal Security Service (FSB). According to the document, marked Top Secret, during this conversation the hackers claimed they could "increase valve pressure, disable alarms, and initiate an emergency shutdown of an unspecified gas distribution station" located in Canada.