Energy giant confirms breach of customer project files
Telvent's systems are used to control pipelines in North America and Latin America
Computerworld - Telvent, a Canadian energy firm whose systems are used to control more than half of all oil and gas pipelines in North America and Latin America, today confirmed a security breach involving the project files of some of its customers.
In a statement, a spokesman from Schneider Electric -- the French energy giant that owns Telvent -- said that the company has informed all affected customers of the breach. They are taking all recommended actions with support from Telvent teams, the company said.
"Telvent is actively working with law enforcement, security specialists and its affected customers to ensure the breach has been contained," Schneider Electric said.
Schneider Electric's confirmation came after security blogger Brian Krebs disclosed how hackers believed to be from China had breached Telvent.
The intruders broke through the company's firewall earlier this month, infiltrated portions of its network, installed malicious software and stole data on customer projects involving a Telvent product called OASyS SCADA, Krebs reported today.
Telvent has disabled all data links between customers and affected portions of its networks as a precautionary move, Krebs noted, quoting from a Telvent customer advisory.
The company has implemented new procedures for providing remote support to clients while it works on ridding its networks and systems of all malware.
"In a series of written communications to clients, the company detailed ongoing efforts to ascertain the scope and duration of the breach," Krebs wrote. "In those communications, Telvent said it was working with law enforcement and a task force of representatives from its parent firm, Schneider Electric."
From Telvent's description of the malware in its alert, the company appears to have been attacked by a notorious Chinese hacking group called the Common Group, Krebs said. The group has been associated with cyber espionage activities against large energy companies and Fortune 500 firms for the past several years, the blogger said.
News of the Telvent breach comes just days after Dell's SecureWorks Counter Threat Unit issued an alert warning about a sustained cyber espionage campaign directed at companies in the energy sector. The alert referred to an attack against Canadian energy companies as well as attacks against an oil company in the Philippines, a military organization in Taiwan and several unidentified entities in Nigeria, Egypt, Brazil and Israel.
A spokeswoman from SecureWork today said that the Canadian energy company referenced in that alert is not Telvent.
The Telvent attack is worrisome, given the enormous presence the company has within energy companies in North America, said Dale Peterson, CEO of Digital Bond, a consulting company that specializes in control system security.
The OASyS project files pertained to a product used to integrate an energy company's backend networks with new smart-grid technology. But if hackers got access to those files, they likely gained access to project files involving other Telvent products used to manage oil and natural gas pipelines, Peterson said.
- Cybersecurity for Dummies eBook This book provides an in-depth examination of real-world attacks and APTs, the shortcomings of legacy security solutions, the capabilities of next-generation firewalls, and...
- 2013 Cyber Risk Report The "Cyber risk report 2013 Executive summary" presents the major findings of HP Security Research's comprehensive dive into today's cyber vulnerability and threat...
- Who's Spying on You? You're aware of the threats of malware to your business but what about the ever-changing ground rules? Cybercriminals today are launching attacks against...
- The Threat Landscape Hardly a day goes by without the discovery of a new cyberthreat somewhere in the world! But how do you keep up with...
- Live Webcast Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- It's not too late...Get Your Mobile Questions Answered Live! How can IT provide seamless and secure mobile communications and collaboration for all? Join this live Webcast as IDG asks an expert panel... All Cybercrime and Hacking White Papers | Webcasts