Suncor Energy Inc. recently fell victim to a cyberattack, potentially marking it as Canada’s largest-scale breach of a gas and oil company.
“Since oil and gas organizations are part of Canadian critical infrastructure, they are attractive targets for extortion because of the importance of these products and services to Canadians,” warned the Canadian Centre for Cyber Security (CCCS) earlier this year.
Back in April, Russian hackers claimed to access Canada’s oil infrastructure, but until now, Canada hadn’t experienced a large-scale attack on their oil companies.
Customers found themselves unable to use the car wash, pay for gas with credit or debit cards, log into the app, use the Petro-Points (a system that lets you save on gas), or access the website.
As of Monday, some of their sites remained cash only, and the point system is still unavailable.
Unfortunately, the company hasn’t revealed the scope of the attack or exactly what happened, but Ian L. Paterson, CEO of Vancouver-based cybersecurity company Plurilock Security Inc remarked that these public issues are only a small part of a larger attack. As early as last Friday, some employees were reportedly unable to access their accounts.
“All of these things put together seem to suggest that there could be a sizable cyber incident that’s taking place,” he says. “I think that this actually could be the Canadian Colonial Pipeline, just in the sense that Suncor is such a large part of the economy.” The comparison is being drawn to the 2021 Colonial Pipeline, America’s largest cyberattack on an oil company.
“If the threat actor has been present and persistent for a long time, it could take a very long time to root them out,” Ian stated. Currently, investigations into the matter are ongoing.
The company has assured its users that no customer, employee, or supplier data has been compromised by the breach. In addition, critical infrastructure like refineries is also currently safe.