Oil & Gas Companies Alerted to Cyber Threats

The oil and gas sector has shown high levels of cyber awareness but low levels of cyber insurance, according to an assessment from Moody's. The credit rating agency conducted a survey in 2023 based on debt issuers in the nonrenewable energy sector and found that over 90% of corporations have dedicated cybersecurity staff. 
 
However, this percentage decreases slightly for midstream companies responsible for transport, storage, and wholesale marketing of petroleum products. Despite no obvious cause for this dip, a spokesperson from Moody's stated the disparity isn't significant. 
 
Interestingly enough, about one-fourth of surveyed companies link CEO compensation to cybersecurity goals achievement—outperforming the global corporate average by 7%. For integrated oil corporations taking care of all business aspects from exploration to distribution, two-thirds tie their CEOs' remuneration with these objectives. 
 
All respondents revealed they have incident response plans tested at least once annually by nine out of ten firms. More than eight out of ten use multifactor authentication for online resources such as email accounts—a figure rising to full marks among large integrated oil conglomerates. However, only around two-thirds regularly backup data compared to the corporate average standing at 81%. 
 
Several high-profile attacks have hit the industry recently, including Colonial Pipeline in 2021, causing temporary gas shortages across southeast America. This attack influenced the Biden administration’s approach towards cybersecurity, leading them to launch international efforts aimed at disrupting ransomware underground activities (see LockBit & Evil Corp Targeted in Anti-Ransomware Crackdown). 
 
In another case involving Halliburton, an oil service giant based in Texas, which reported unauthorized network activity resulting in stolen data late August last year; likewise, Repsol, a Spanish multinational company, informed natural gas customers about a third-party technology provider experiencing breached data, including personal details like names, national ID numbers, and addresses, in September of the of the same year. 
 
Janko Lukac, vice president focused on oil and gas sectors at Moody's, warned, "Energy production is key for national security and hence a sensitive topic. If something goes wrong, there are direct consequences for end consumers.". 
 
The survey also found that although most companies in the sector are embracing private cloud technology, they prefer to keep IT infrastructure on-site. The few who use public cloud computing stick with one provider except firms based in Europe, Middle East, and Africa, where nearly two-thirds reported using more than one. 
 
Cyber insurance uptake is below the corporate average at approximately 80%. Half of the sector firms have this coverage, which Moody’s attributes to high confidence in internal security measures and risk management practices as well as cost quality concerns about insurance products. 
 
Lukac added: "Potential damages can be quite costly (considering potential production losses/environmental damages). Due to the magnitude and severe consequences of some risks, it is often not economically viable to find decent insurance cover." 
 
Most cybersecurity customers complain about soaring premiums; however, rates have grown by 315% between 2020 and 2022 within oilfield services, according to Moody's data. Overall sector premiums have risen by 70% during this period, surpassing a corporate average growth rate standing at around half.