The Suncor Energy Centre picture in downtown Calgary, Alta., Friday, Sept. 16, 2022. THE CANADIAN PRESS/Jeff McIntosh
CALGARY — The systems breach at Suncor Energy Inc. will likely cost the company millions of dollars before it is able to resolve the issue, according to a cybersecurity expert.
Jon Ferguson, general manager of cybersecurity at the Canadian Internet Registration Authority, made the comments in an interview Tuesday, two days after the Calgary-based oil and gas giant issued a news release saying it had experienced a “cybersecurity incident.”
As of Tuesday afternoon, the cyberattack was still affecting many of Suncor’s Petro-Canada retail locations across the country, with many still unable to accept credit or debit payments.
The company’s Petro-Points app and website also remained unavailable.
Suncor has declined to provide details about the type of attack or which other parts of its operations may have been affected, but Ferguson said it’s fair to assume that it will take some time before the company can get back to normal.
“One of the challenges here is it’s a very big organization, and being a very large organization it doesn’t lend itself to this being a quick scenario,” Ferguson said.
“If they have to go in and modify critical systems, that can take a very long time to recover, depending on what’s damaged.”
The longer it takes to address the problem, the larger the bill for Suncor, he added. Cyberattacks are notoriously costly for their corporate victims, who may end up paying off the criminals in the event of a ransomware attack, or who may be forced to provide ongoing credit monitoring and reporting services for customers in the event that personal data was stolen.
Companies can also face costs in the form of lawyers’ fees, as well as the hiring of “data breach coaches” and specialized IT specialists, Ferguson added.
“And then there’s the cost of disruption. I have no idea how much gas Petro-Canada didn’t sell because people didn’t have cash,” he said.
“There’s also the cost of reputational and brand damage, which is very hard to measure, but you’re probably going to think twice before you slip your credit card into a Petro-Canada gas machine now.”
According to a report by IBM, the global average cost to companies of a data breach hit an all-time high in 2022 of US$4.35 million, a 13 per cent increase from 2020.
In the United States, the average cost of a data breach in 2022 was US$9.44 million.
The IBM report said that in 2022, it took an average of 277 days — about 9 months — for companies to identify and contain a breach, and that time is of the essence for companies looking to avoid spiralling costs.
“Days saved are dollars saved when it comes to a data breach,” the report stated.
Suncor’s cybersecurity woes come as the company has been seeking to improve its financial performance after a recent spate of operational issues and workplace safety incidents.
Earlier this month, the company said it would cut 1,500 jobs by the end of the year in an effort to reduce costs.
But while this week’s systems breach is certainly bad news for Suncor, the oil and gas giant is far from alone when it comes to falling victim to cybercrime.
According to the Canadian Internet Registration Authority, 44 per cent of Canadian organizations surveyed in 2022 said they had experienced a cyberattack in the last 12 months.
Three-in-ten organizations surveyed said they had experienced a breach of customer or employee data, while 22 per cent said they had been a victim of a successful ransomware attack.
Of those organizations who said they had experienced a ransomware attack, 73 per cent paid the ransom demands.
This report by The Canadian Press was first published June 27, 2023.
Companies in this story: (TSX:SU)
Amanda Stephenson, The Canadian Press
- 0073 SaskWorks-Pipeline Online0073 SaskWorks-Pipeline Online
- 0072 Outlaw Buckers and Oil Kings 20240072 Outlaw Buckers and Oil Kings 2024
- 0069 Sask Oil Show 2024 banquet tickets0069 Sask Oil Show 2024 banquet tickets
- 0071 Pride Upkeep 2024 Packages0071 Pride Upkeep 2024 Packages
- 0070 Sask Oil Show 2024 pre-register0070 Sask Oil Show 2024 pre-register
- 0068 Sask Oil Show 2024 booth0068 Sask Oil Show 2024 booth
- 0067 PFM SaskWorks Payroll Investment Plan0067 PFM SaskWorks Payroll Investment Plan
- 0066 WBPC Promo video 30 seconds0066 WBPC Promo video 30 seconds
- 0064 Estevan OTS0064 Estevan OTS
- 0063 Turnbull Excavating hiring crusher0063 Turnbull Excavating hiring crusher
- 0062 TED_EPAC_Technology_300062 TED_EPAC_Technology_30
- 0061 SIMSA 2024 For Sask Buy Sask0061 SIMSA 2024 For Sask Buy Sask
- 0058 Royal Helium Steveville opens anonymous rocket0058 Royal Helium Steveville opens anonymous rocket
- 0055 Smart Power Be Smart with your Power office0055 Smart Power Be Smart with your Power office
- 0052 Predator Inspections0052 Predator Inspections
- 0051 JML Hiring Pumpjack assembly0051 JML Hiring Pumpjack assembly
- 0049 Scotsburn Dental soft guitar0049 Scotsburn Dental soft guitar
- 0046 City of Estevan This is Estevan0046 City of Estevan This is Estevan
- 0041 DEEP Since 2018 now we are going to build0041 DEEP Since 2018 now we are going to build
- 0032 IWS Summer hiring rock trailer music
- 0022 Grimes winter hiring
- 0021 OSY Rentals S8 Promo
- 0018 IWS Hiring Royal Summer
- 0015 Latus Viro0015 Latus Viro
- 0013 Panther Drilling PO ad 03 top drive rigs
- 0011
- 0006 JK Junior
- 0002 gilliss casing services0002 gilliss casing services
- 9002 Pipeline Online 30 sec EBEX9002 Pipeline Online 30 sec EBEX
- 9001