Assessment of Ransomware Event at U.S. Pipeline Operator
Summary: CISA reported on 18 February 2020 that ransomware hit a natural gas compression facility at an unidentified U.S. pipeline operator, causing loss of view and control in both IT and ICS assets, a controlled shutdown, and two days of downtime. Dragos confirmed the CISA alert describes the same event the U.S. Coast Guard reported in December 2019, where Ryuk ransomware was deployed after an initial breach via phishing containing a malicious link.
Key Takeaway: The intrusion reached data historians and HMIs but not PLCs, yet pipeline operations still stopped for two days - a consequence of insufficient IT/ICS segregation and shared Windows infrastructure rather than any ICS-specific attack.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026