Rise of cyberattacks affects European oil facilities

Cyberattacks targeting oil loading facilities have spread to key terminals in the Amsterdam-Rotterdam-Antwerp (ARA) refining hub, having affected operations in Germany earlier in the week.

This is especially impacting the flow of oil products such as heating oil, diesel, jet fuel, gasoline and fuel oil in Antwerp, Hamburg, Amsterdam, Ghent and Terneuzen, with many cargoes and barges being diverted to other terminals in the region.

The first incident to come to light took place at two German oil companies, OilTanking and Mabanaft, which operate under the same Hamburg-based parent, Marquard & Bahls, a logistics specialist. This ongoing attack, which, it has emerged, is very likely the work of the BlackCat ransomware group, has had a small impact on retail fuel supplies in Germany.

The incidents are mainly affecting the loading and unloading of cargo at the impacted facilities, and it can be expected that should normal operations not resume soon, these impacts will spread into the shipping and logistics sector.

A total of 17 terminals (11 in Germany and six in ARA) have so far been affected. The Belgian authorities and the Dutch National Cyber Security Centre are investigating the incidents, and are being supported by Europol.

According to a report, there have been more than 20 cyber security incidents over the past two years targeting companies operating in commodity markets from energy to metals. Last year, the Colonial Pipeline in the US halted all operations because of a cyberattack involving ransomware. The line was the primary artery for gasoline and refined products for much of the US Gulf Coast and Atlantic Coast delivering more than 100 million gallons/day of fuel and heating oil.