Suncor Energy continues to investigate a cybersecurity incident that has impacted transactions at gas stations across Canada.
The Calgary-based energy provider disclosed the incident in a statement Sunday, warning that some customer and supplier transactions were impacted.
The company retained third-party forensic experts and notified authorities, however said there was no evidence that customer or supplier data had been compromised or misused.
“At this time, we are not aware of any evidence that customer, supplier or employee data has been compromised or misused as a result of this situation,” Suncor said in a statement released earlier this week.
Petro-Canada, a subsidiary of Suncor with more than 1,500 locations, said some of its locations could only accept cash and its mobile app and rewards points were not currently available. The company also warned that car wash locations were unavailable.
Just days before the incident, Canadian authorities warned of potential attacks against the nation’s oil and gas sector.
The Canadian Centre for Cyber Security said state-sponsored actors were likely targeting operational technology networks in an attempt to disrupt the country’s oil and gas supply.
A spokesperson for the Communications Security Establishment said the agency was aware of media reports of the Suncor incident, but declined to comment further on specific cyber incidents.
This incident is being compared by some to the 2021 ransomware attack against Colonial Pipeline, when gas supplies were disrupted to much of the Southeastern and Eastern U.S. for almost a week.
However, in the Suncor incident there is no immediate disruption being reported in actual fuel supply and there’s no evidence of a ransom demand or mass data exfiltration.
The Cybersecurity and Infrastructure Security Agency referred all queries directly to Suncor, and officials at the company were not immediately available for comment.
Mike Hamilton, co-founder and CISO of Critical Insight, noted this was not the first time the Canadian oil and gas industry has been targeted.
“According to the intelligence report, these events will likely continue for the duration of the war in Ukraine and are intended to produce psychological impacts in the population and yes, the United States is also a target for this activity,” Hamilton said via email.
