Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

ICS/OT

Italian Oil Services Company Saipem Hit by Cyberattack

Italian oil and gas services company Saipem reported on Monday that some of its servers were hit by a cyberattack.

Italian oil and gas services company Saipem reported on Monday that some of its servers were hit by a cyberattack.

The company has shared few details about the attack – it’s unclear if it was ransomware or another type of intrusion – but its representatives told SecurityWeek that no data was stolen and that only some servers in its infrastructure were impacted.

Saipem says it’s in the process or restoring affected servers using available backups, which the company claims are “safe.”Italian oil and gas company Saipem hit by cyberattack

“We have no proof of the origins or reasons for the attack, though this is being investigated,” a Saipem spokesperson said via email.

The company did however tell Reuters that the attack mainly impacted servers in the Middle East, including Saudi Arabia, the United Arab Emirates and Kuwait.

Saipem told Reuters the attack originated in Chennai, India, but that does not necessarily reveal the identity of the attacker as malicious actors often use random servers from around the world to hide their true location.

Learn More About Security in the Oil & Gas Sector at SecurityWeek’s ICS Cyber Security Conference

Saipem describes itself as “one of the world leaders in drilling services, as well as in the engineering, procurement, construction and installation of pipelines and complex projects, onshore and offshore, in the oil & gas market.” The company has customers in more than 60 countries, including Saudi Arabian oil and gas giant Saudi Aramco.

Phil Neray, VP of Industrial Cybersecurity at CyberX, says the target itself provides some clues as to who may be behind the attack.

“It’s still too early to tell, but given Saipem’s position as a trusted 3rd-party supplier to Saudi Aramco, an educated guess would be that the adversary is the same one that attacked Saudi Aramco in the past — which points to the destructive Shamoon attacks of 2012 and 2016, now widely-attributed to Iran,” Neray told SecurityWeek.

A study conducted earlier this year by Ponemon Institute on behalf of German industrial giant Siemens revealed that many oil and gas companies in the Middle East had suffered at least one serious security incident in the previous year.

Related: U.S. Oil and Gas Industry Lagging in Security

Related: Assessing Cyber and Physical Risks to Oil & Gas Sector

Related: Several U.S. Gas Pipeline Firms Affected by Cyberattack

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Data Breaches

GoTo said an unidentified threat actor stole encrypted backups and an encryption key for a portion of that data during a 2022 breach.

CISO Strategy

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make...

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.

ICS/OT

Otorio has released a free tool that organizations can use to detect and address issues related to DCOM authentication.

Cybercrime

CISA, NSA, and MS-ISAC issued an alert on the malicious use of RMM software to steal money from bank accounts.

Incident Response

Cygnvs emerges from stealth mode with an incident response platform and $55 million in Series A funding.

Cybercrime

Chinese threat actor DragonSpark has been using the SparkRAT open source backdoor in attacks targeting East Asian organizations.

ICS/OT

Vulnerabilities in GE’s Proficy Historian product could be exploited for espionage and to cause damage and disruption in industrial environments.