Oil and gas cyber incidents by year and record status
| Year | Incident | Where | Record status |
|---|
| 2021 | Colonial Pipeline | US East Coast | DarkSide ransomware, per the FBI |
| 2017 | Triton | Middle East refinery (site never officially named) | Site never officially named |
| Disclosed 2020 | US Gas Compression | United States (facility unnamed) | Facility and actor undisclosed |
| 2020 | CPC Corporation Taiwan | Taiwan | Attributed by Taiwan's Investigation Bureau |
| 2012 | Shamoon | Saudi Arabia and Qatar | No formal government attribution |
| 2024 | Halliburton | United States and global | Linked to RansomHub by press only |
| 2022 | Pipedream | No victim on record | Toolkit; no recorded use |
| 2025 | KAMACITE / VOLTZITE | United States | Single-vendor reporting |
What the headlines got wrong about oil and gas cyberattacks
One widely repeated claim from each entry, and what the record says. Each entry lists more, with sources.
| Widely repeated claim | What the record says | Entry |
|---|
| "Colonial shut down because billing was hacked." | Unnamed sources to CNN. The sworn reason is containment. | Colonial Pipeline |
| "The operator left the key switch in PROGRAM mode." | CISA says the malware requires PROGRAM mode. The claim about this site traces to vendor remarks at a January 2018 conference, not to the advisory, the victim or any federal filing. | Triton |
| "Russian Wizard Spider's Ryuk Malware" was the attacker. | No document about this incident names Wizard Spider or Russia. CISA names no family and no actor; Ryuk rests on Dragos's sourced join. | US Gas Compression |
| "Recovery cost $3 million to $6 million, and more than 1,000 gas stations were affected." | No source found for either figure. CPC has published no cost and no station count. | CPC Corporation Taiwan |
| "35,000 computers were partially wiped or totally destroyed." | Aramco's figure is about 30,000 workstations, which it said were cleaned and restored to service. The 35,000 figure is CNNMoney's, in 2015. | Shamoon |
| "Halliburton reports $35 million loss after ransomware attack." | The 10-Q reports $35 million of expenses for advisors, restoring systems, legal fees and payroll related costs, not a loss. No Halliburton filing uses the word "ransomware." | Halliburton |
| "Pipedream is Russia-linked." | The only Russia link is Mandiant's, stated with its own qualifier. Dragos makes no assessments about attribution. The article's body quotes Mandiant's reasoning; the headline drops the hedge. | Pipedream |
| "KAMACITE is a Russia-linked group." | That is SecurityWeek's label, not Dragos's. Dragos "does not corroborate nor conduct political attribution to threat activity," and its KAMACITE page records an overlap with SANDWORM activity, not an attribution. No government document addresses this 2025 activity. | KAMACITE / VOLTZITE |
BlastWave analysis: who stopped the line
Analysis, not a disclosed factAcross the eight entries, the shutdowns on the record were operator decisions: Colonial stopped its pipeline to contain an intrusion on its business network, and the gas compression operator chose to shut down after ransomware reached its operator screens. Where the record places an attacker on a safety system, at Triton, the controllers failed safe. That is BlastWave's reading of the record, not a finding of any investigator. It is why the entries' recommendations focus on what the physical operation needs from the business network, and on removing the remote paths that reach engineering and safety systems.
Frequently asked questions
What are the major cyberattacks on the oil and gas industry?
The Oil and Gas edition documents eight: the Shamoon wiper at Saudi Aramco (2012), Triton at a Middle East refinery (2017), ransomware at a US natural gas compression facility (disclosed 2020), CPC Corporation Taiwan (2020), Colonial Pipeline (2021), the Pipedream toolkit (disclosed 2022), Halliburton (2024), and Dragos's reporting on the KAMACITE and VOLTZITE groups (2025).
Did hackers take control of Colonial Pipeline?
No compromise of the pipeline's control systems was shown. A ransom note was found on Colonial's business network on 7 May 2021, and its own control center stopped the pipeline in about fifteen minutes to contain it. As of June 2021, Mandiant had confirmed no evidence that the control systems were reached. The FBI attributed the attack to DarkSide ransomware.
What was the Triton attack?
In 2017 an attacker reached the Triconex safety controllers at a Middle East refinery and tried to reprogram them with TRITON malware. The controllers failed safe, and the Justice Department says the plant went through two automatic emergency shutdowns. No government, company or filing has named the site; Petro Rabigh in Saudi Arabia is press attribution only.
Has a cyberattack ever stopped oil and gas operations?
In this edition the stoppages on the record were operator decisions. Colonial stopped its pipeline in May 2021 to contain an intrusion on its business network. At a US natural gas compression facility described by CISA in 2020, the operator chose to shut down after ransomware reached its operator screens, and the pipeline asset was down for about two days. Saudi Aramco said in 2012 that oil production never stopped.
Who was behind the Shamoon attack on Saudi Aramco?
No government has formally and publicly attributed the August 2012 attack. It was claimed on Pastebin by the "Cutting Sword of Justice" and, separately, an "Arab Youth Group." Saudi Arabia's Interior Ministry described an organized group operating from abroad and named no state.
How does Hackopedia verify an oil and gas incident?
Every figure, date and quotation in an entry traces to sworn testimony, a court record, a government or regulator document, the company's own dated statements or filings, a named researcher's published work, or a dated publication named as such. Claims resting on press or unnamed sources are marked as reported, and errors in Hackopedia's own first volume are corrected on the page.
Other editions
Cite this page
BlastWave. “Cyberattacks on Oil and Gas: The Verified Record (2012 to 2025).” Hackopedia, Volume 2, Oil and Gas edition. Last verified 28 September 2026. https://hackopedia.blastwave.com/oil-and-gas/
Revision history
| Date | Change |
|---|
| 5 Oct 2026 | Oil and Gas edition published with eight entries. FILE numbers run across all of Hackopedia Volume 2, not by edition. |
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
