Pemex seen as highly exposed to cyberattack

Mexico’s congressional auditing entity ASF has issued a new warning to Pemex that its infrastructure is at high risk of suffering another cyberattack.

The state-oil company was already hit by a major ransomware attack in November 2019.

The new ASF report said Pemex’s computer systems remain obsolete and still lack critical security patches, although the company had more than one year to beef up its digital defenses.

In the US, oil and gas company Colonial is currently grappling with a cyberattack on a pipeline which is causing intensifying gasoline shortages in the country’s southeast.

The ASF said during the 2019 attack, 5% of Pemex’s computer equipment became compromised with hackers stealing information from 1,816 computers.

They demanded 565 bitcoin, equivalent to US$4.9mn, to end the attack. Pemex presumably paid but company representatives still dodge questions on the topic.

In its audit of the 2019 attack, ASF said the poorly updated equipment allowed the hackers to halt strategic operations in many company areas, also causing the loss of sensitive files.

According to the report, 76% of the hijacked servers were running an operating system for which Microsoft had already stopped providing security updates. The old operating system was in place even though Pemex had invested 11.5bn pesos (US$570mn) in information systems and technological infrastructure from 2015 to 2019.

Out of Deer Park

In other news, Pemex CEO Octavio Romero Oropeza confirmed the company’s plan to eliminate its subsidiary PMI Holdings BV, a joint venture with Shell at the multinational’s Deer Park refining facility in Texas. 

Oropeza said the move is part of a corporate re-organization to trim the number of subsidiaries to 10 from 25, which are operated by the PMI Comercio Internacional international sales division. 

Some units have already been transferred to or merged with other units. “We have reduced eight,” leaving 12, but “the goal is to reach 10,” Oropeza said. 

The liquidation of PMI Holdings BV was authorized during the December 2 board meeting, energy news outlet Energía a Debate reported on Thursday.

The board, whose president is energy minister Rocío Nahle, “authorized the liquidation of PMI Holdings BV in the terms presented, and instructed the administration to carry out the corresponding acts and obtain the authorizations required,” according to the report.