Oil terminals hit by cyber-attack
Criminals target stocks for roadside service stations
All sorts of oil products are stored at the Netherlands' sea ports for onward distribution. In recent years, however, the industry has become an attractive target for cybercriminals, on account of its economic importance and the high value of the traded commodities. Earlier this month, crooks launched a major cyber-attack on multiple targets in the Netherlands and Germany.
Various forms of cybercrime
It's not the first time that the trade in petroleum products has come in for the unwanted attention of cybercriminals. For several years now, fraudsters have been offering non-existent fuel stocks and storage capacity (a scam known as 'storage spoofing'). In the latest incident, Dutch and German storage facilities were hit by a cyber-attack that obliged roadside service stations to rethink their fuel stocking arrangements.
Possible ransomware
Although the affected companies didn't release details of the attack, reports suggest that there was an attempt to hijack oil installations using ransomware: software that makes data and systems inaccessible until the victim pays the attackers a ransom. The targeted facilities form part of the infrastructure that supplies roadside service stations with fuel. And the attack came at a time when fuel prices were already rocketing. If it had succeeded, the attack would have placed the victims in a precarious situation, while giving the criminals a strong negotiating hand.
Gangsters or state actors?
Although the authorities refer to the attackers having a 'criminal motive', it's questionable whether the perpetrators were simply money-motivated crooks. Cyber-attacks on critical infrastructure often appear to be the work of state actors with political aims. The distinction between cybercrime and cyberwarfare is increasingly vague.
Mixed outcome
Reports indicate that the attack wasn't entirely successful. Although hampered by the incident, the victims were able to continue operating by falling back on manual systems. And not all companies active in the sector were affected, meaning that service stations were able to find alternative sources of supply.
Protection of critical infrastructure is vital
In recent years, the security of critical infrastructure has been the focus of increasing attention. For example, we've been helping the Port of Rotterdam to identify and disable malicious websites with .nl domain names. Such proactive threat identification and neutralisation, as offered by SIDN BrandGuard, is set to become still more important to large organisations in the years ahead.