INDUSTRY FACT FILE · OIL, GAS & PETROCHEMICALS

Threat Landscape: Top Cyber Threats Facing Oil, Gas and Petrochemicals

The 18 most relevant cyber threats, attacks and industry challenges for exploration companies, pipelines, refineries, terminals and fuel distributors.

Oil and gas attracts criminals seeking ransom from operations that cannot stop, state-backed actors seeking intelligence or disruptive capability, and destructive attacks designed to cause maximum damage. Contractors, vendors and remote sites widen the attack surface.

Landmark incidents—Shamoon (2012), TRITON's targeting of safety systems (2017), the precautionary shutdown of a major US pipeline after IT ransomware (2021) and a reported ransomware attack on an Indian oil company in 2022—show the range of impact.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by oil and gas segment (Codec Networks assessment).

4.1 Ransomware and IT-dependent shutdowns

Even when OT is untouched, operators may shut down because billing, scheduling or custody-transfer systems on IT are unavailable or trust is lost.

• Questions to test: Which operational processes depend on IT? Can OT run safely and commercially without IT for a period? Are backups immutable and tested?
• Relevant services: dependency mapping, segmentation, backup and recovery testing, crisis exercises.

4.2 Safety instrumented systems

Attacks on SIS aim to disable the last layer of protection. Engineering workstations with access to safety controllers are the critical path.

• Questions to test: Are SIS networks isolated? Are controllers in run mode with physical key control? Are engineering workstation actions monitored?
• Relevant services: SIS security review, engineering workstation controls, OT monitoring.

4.3 Contractors and vendors

Turnarounds bring hundreds of contractors and laptops into plants, and vendors often hold permanent remote access to control systems.

• Questions to test: Are contractor devices scanned and segmented? Is vendor access brokered and recorded? Are accounts removed after work?
• Relevant services: third-party access programme, scanning kiosks, remote access review.

4.4 Destructive malware and espionage

Wipers and state-backed intrusions target corporate networks and valuable exploration and process data.

• Questions to test: Is privileged access tiered and protected? Are critical datasets backed up offline? Is there threat hunting?
• Relevant services: PAM review, offline backups, EDR, SOC and hunting.

4.5 Detection and the 6-hour clock

CERT-In requires reporting within six hours of noticing an incident. OT environments are often unmonitored, delaying detection.

• Questions to test: Are IT and OT monitored 24x7? Is there a playbook combining safety, operations and reporting decisions?
• Relevant services: IT/OT SOC, playbooks, joint drills with operations and safety teams.

• CERT-In: incidents reported within six hours of noticing them.
• NCIIPC: incidents affecting notified critical information infrastructure require coordination.
• Safety regulators: incidents affecting safety systems or causing process upsets may trigger safety investigations under applicable rules.
• PNGRB: incidents affecting pipeline or city gas integrity and supply may require regulatory engagement.
• Consumers: retail, LPG and CGD incidents involving personal data trigger DPDP obligations once breach provisions commence in May 2027.

• Would an IT ransomware attack force us to shut down operations?
• Are our safety instrumented systems isolated and their engineering workstations monitored?
• How do we control contractor devices and accounts during turnarounds?
• Which vendors can reach our DCS and SCADA, and is their access recorded?
• Do we have offline backups and a tested restart plan for OT?
• Could we report an incident to CERT-In within six hours while keeping operations safe?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific organisation. Public incident references are summarised from widely reported events.