Saudi Aramco hit by cyber attack, hackers demand $50 million ransom in Bitcoin

Saudi Aramco, the world's largest oil producer, has had 1TB of proprietary data stolen by cyber attackers and put on the dark web for sale. A threat group called ZeroX has demanded a $50 million ransom in cryptocurrency. Saudi Aramco confirmed on the 21st that some of its files had been leaked.

ZeroX claims the data was stolen by hacking into Saudi Aramco’s networks and servers sometime in 2020. The most recent of the stolen files are from 2020, while others date back to 1993.

In order to attract potential buyers, the stolen data samples of Saudi Aramco were first posted on the market forum in June this year. The hackers offered Saudi Aramco to delete the data from the dark web if Saudi Aramco paid $50 million in cryptocurrency.

It is reported that when the data sample was initially released, the countdown for sales and negotiations was set to 662 hours (about 28 days). ZeroX said that the setting of "662 hours" was intentional and was a "difficult problem" that Saudi Aramco wanted to solve, but the exact reason behind this setting is still unclear. Some analysts believe that the countdown timer was set only to attract potential buyers and to create a sensation during the sales process.

The group said the 1TB of data covered documents related to Saudi Aramco's refineries in several Saudi cities, including Yanbu, Jizan, Jeddah, Ras Tanura, Riyadh and Dhahran.

The data includes: complete information of 14,254 employees, project specifications involving/including systems such as electricity, architecture, engineering, civil, construction management, environment, machinery, ships, and telecommunications; internal analysis reports, agreements, letters, price lists, etc.; planned IP addresses, access points, IP cameras, etc.; location maps and precise coordinates; and Saudi Aramco's customer lists, invoices, and contracts.

ZeroX revealed that so far, there have been five buyers negotiating deals with them for this data.

However, Saudi Aramco denied that this was a ransomware incident and tried to downplay the impact of the incident, saying that the leaked data was originally in the hands of a third-party contractor and that the company's own systems had not been hacked. Saudi Aramco said in an email on Wednesday:

"We have confirmed that this data leak was not caused by a hack into the company's system and does not affect the company's operations."

The global energy industry has suffered an increase in cyber attacks this year, with the most sensational being the hacking of Colonial Pipeline, the largest refined oil pipeline operator in the United States, at the beginning of the year. Some consulting firms say that the oil and gas industry, including companies that own oil wells, pipelines and refineries, has long lagged behind in investment in maintaining cybersecurity.

The Middle East has been the target of some of the world's highest-paid hackers, accounting firm PricewaterhouseCoopers said in a 2016 report.

In 2012, Saudi Aramco's Khurais plant was hit by a vicious cyberattack that wiped out data on three-quarters of Aramco's computers. Saudi Arabia has blamed the hacking on unidentified actors abroad who were intended to disrupt production in the world's largest crude exporter.

Two weeks after Saudi Aramco was attacked, Qatari gas giant Ras Gas was hit by a similar attack.