Data Insights Report
A spotlight on legacy systems
The corporate supply chain in the energy sector is vast and complex, spanning from specialised equipment manufacturers to software providers and contractors. While this expansive web of services facilitates the scale of operations of modern energy companies, it also offers a significant attack surface for malicious actors looking to compromise energy companies' security through their third-party vendors.
Thus, managing third-party risks is now an essential part of security operations for global energy companies. A data breach at a third-party vendor can also compromise the operations, reputation, and finances of its clients and partners in the energy sector. In fact, an incredible 90% of global energy companies have experienced a third-party data breach to date.
Securing your corporate supply chain should thus be top of your list. Here, we will explore the world of third-party risk management (TPRM) within the energy industry.
Third-party risk management (TPRM) involves identifying, assessing, and mitigating the risks associated with third-party vendors and partners. TPRM is critical in the energy sector because disruptions or failures within organisations’ corporate supply chains have far-reaching consequences.
An energy company's production, distribution, or even national security could be compromised if a vendor’s security is breached. That's why effective TPRM is so crucial. It helps energy companies:
The energy sector faces a unique set of risks regarding third-party relationships. Some of the most significant include:
As energy systems become more digitised and interconnected, the risk of cyber attacks targeting suppliers of critical infrastructure such as energy increases. A breach in a vendor's network potentially gives attackers access to sensitive data or even control systems, with potentially disastrous consequences.
The energy industry relies heavily on a vast network of suppliers for equipment, materials, and services. Any disruption in this supply chain, whether due to financial instability, natural disasters, geopolitical tensions or cyber security incidents at these suppliers' own sub-contractors and outsourcing partners, can severely impact operations.
Energy companies must comply with a complex web of regulations and standards, many of which extend to their third-party relationships. Failure to ensure vendor compliance can result in fines or legal repercussions.
Third-party vendors and contractors are pivotal in maintaining and supporting energy infrastructure. Mismanagement, negligence, or lack of expertise on their part, leading to breaches, can lead to operational failures, safety incidents, or environmental disasters.
The energy sector is governed by a comprehensive array of laws and regulations that span various domains, including interstate energy transmission, environmental conservation, cybersecurity, and anti-bribery practices.
This regulatory overview highlights some of the overarching laws and regulations that govern the energy industry.
To underscore how important it is to safeguard your corporate supply chain, let's consider several incidents that illustrate the potential consequences of supply chain incidents.
Specifically, a 2023 report by SecurityScorecard showed that 90% of the world’s top energy companies experienced data breaches caused by third-parties in 2023. These breaches not only leaked sensitive information but also raised doubts about the industry’s security protocols across the board.
These incidents resulted in financial losses, reputational damage, and destroyed customer confidence. Among the key finding of the report are:
Five notable recent data breaches in the energy sector include:
From 2019 to 2020, a cyberattack struck the software supply chain of IT infrastructure management company SolarWinds’ Orion platform. Linked to Russian state-sponsored hackers, the breach began by compromising the company’s supply chain, enabling the attackers to plant malware on the networks of SolarWinds’ customers.
The attackers altered a plugin on the Orion platform, creating a backdoor that allowed them to control third-party servers, exfiltrate data, and deploy additional malicious code. The breach impacted several U.S. federal government agencies, including the Departments of Justice, Homeland Security, and Treasury, along with over 18,000 other customers, including many in CNI sectors such as electrical and energy. The attacks were eventually mitigated through rapid hotfixes and global security patches issued by Microsoft.
In March 2023, a cyberattack targeted the corporate supply chain of 3CX, a company with approximately 600,000 global customers and 12 million daily users. This attack also affected two energy firms and two financial traders, stemming from a previously compromised trading software downloaded by an employee.
The malware implemented a multi-stage backdoor allowing the attackers to steal corporate login credentials from the employee’s device and move through 3CX’s network. The malware’s automatic startup on devices provided attackers with remote access to all connected systems.
In May 2021, a ransomware attack targeted Colonial Pipeline, the largest fuel pipeline in the US, which supplies nearly half of the East Coast's transport fuel. The DarkSide hacking group gained access to and encrypted corporate data, threatening to leak it unless Colonial paid the ransom.
The pipeline and its IT and OT systems were pre-emptively shut down for several days, leading to a potential international fuel supply crisis. Eventually, a $5 million ransom was paid to restore the data, concluding one of the most significant attacks against critical infrastructure in the US.
In February 2021, Brazilian state-owned utility companies Centrais Elétricas Brasileiras (Eletrobras) and Companhia Paranaense de Energia (Copel) were hit by ransomware attacks from DarkSide, the same group behind the Colonial Pipeline incident.
The attack on Copel led to some operations and services going offline, with 1,000 GB of sensitive data stolen and leaked. Eletrobras’ subsidiary, Eletronuclear, which operates two nuclear power plants, also suffered an attack. While some operations were suspended to protect data, the operational technology systems running the nuclear plants remained isolated and unaffected.
In 2017, the rogue code Triton was discovered targeting a petrochemical plant in Saudi Arabia. Triton enables hackers to remotely control a plant’s safety systems, potentially disabling them in dangerous situations. Fortunately, a flaw in the code led to the hackers being detected before any harm could be inflicted.
The attackers are believed to have infiltrated the Saudi Arabian petrochemical company’s IT network as early as 2014 through a spear phishing attack. This provided access to a poorly configured firewall and an engineering workstation. Now, the hackers behind Triton are targeting companies in North America and worldwide.
As the regulatory landscape and risk factors continually evolve, energy companies must reinforce their third-party risk management (TPRM) practices. Regular assessments and strategy updates are crucial for maintaining compliance and safeguarding operations. Implementing these key best practices can strengthen TPRM:
By adopting these practices, energy companies can implement a strong, dynamic third-party risk management programme that reduces operational risks, ensures compliance, and cultivates trustworthy business partnerships - protecting the company's reputation and financial standing.
Navigating the complex world of third-party risk management in the energy industry can be challenging, but you don't have to go it alone. Risk Ledger is the first global network of connected organisations all working together to defend-as-one, detecting, responding, and ultimately preventing cyberattacks against our supply chains.
With Risk Ledger, you can streamline your entire third-party risk management lifecycle, from vendor onboarding and due diligence to continuous monitoring and risk reporting. The platform's advanced features include:
By partnering with Risk Ledger, you can streamline your third-party risk management processes, enhance compliance, and proactively address potential vulnerabilities within your corporate supply chain. Don't let third-party risks jeopardise your operations – take control with a comprehensive solution tailored to the energy industry's unique needs.
In the ever-evolving energy landscape, where third-party relationships are integral to business operations, effective risk management is no longer just a best practice – it's an essential component of a responsible business operation. By implementing the strategies and leveraging tools outlined in this guide, you can fortify your defences against the myriad risks lurking within your corporate supply chain.
Remember, the consequences of inadequate third-party risk management can be severe, ranging from operational disruptions and financial losses to regulatory penalties and irreparable reputational damage.
Sign up to our monthly newsletter to receive exclusive research and analyses by our experts, the latest case studies from our clients as well as guides, explainers and more to turn your supply chain risk management programme into a resounding success story.
