Natural Gas Operator Shuts Down after Phishing Attack and Ransomware

Internal Threats: Natural Gas Operator Shuts Down After Phishing and Ransomware Attack

A U.S. natural gas compression facility was forced to shut down operations for two days following a ransomware infection that originated from a phishing attack, according to the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA).

How the Attack Unfolded

• The incident began when an employee clicked a malicious link in a phishing email.
• This allowed attackers to pivot from the IT network to the OT network — the operational technology environment responsible for controlling and monitoring the physical processes of the facility.
• Both IT and OT networks became infected with commodity ransomware.
• Although programmable logic controllers (PLCs) controlling the gas compression equipment were not compromised and operational control was not lost, crucial control and communication systems used by employees were knocked offline.

Impact

• Operational downtime: 2 days of halted operations.
• Loss of real-time monitoring capability for critical processes.
• Highlighted vulnerabilities in OT security and insufficient network segmentation.

Key Lessons

1. OT networks are the crown jewels of industrial environments — they must be isolated, secured, and accessible only when strictly necessary.
2. Employee security awareness is critical.
   • Most ransomware infections still begin with phishing emails.
   • Teaching employees to identify and avoid suspicious links or attachments reduces risk significantly.
3. Cybersecurity metrics and monitoring should extend beyond IT and include OT environments to detect anomalies early.

Kymatio helps organizations design human-centered insider risk mitigation plans that combine technical controls with employee training, reducing the likelihood of human-originated incidents like this one.

🔗 Full article by Ars Technica:https://arstechnica.com/information-technology/2020/02/ransomware-infection-shuts-down-us-natural-gas-operator-for-2-days/