Cyber Insurance as a Risk Management Tool in the Oil & Gas Industry

The current view of cyber insurance as a viable risk transfer tool for Oil & Gas companies is reflected in the relatively low take-up of meaningful cyber insurance limits purchased across the industry. According to an assessment from credit rating agency Moody’s, only half of sector firms carry cyber insurance, well below the corporate average of 80%.

The hesitation to embrace cyber insurance seems to mirror the electric and gas utility industry’s view of cyber risk management from 10-12 years ago. At that time, there was a common industry belief that cyber insurance only addressed data privacy and data breaches, while the industry’s true concern centered on the operational exposure to a cyber event and the potentially catastrophic impact it could have to operations, balance sheets, customers, and shareholders.

It was at this point in the evolution of cyber insurance that a small number of specialized insurance brokers and insurance carriers or syndicates began to craft solutions tailored specifically to the exposures faced by the broader utility industry. Coverage provisions such as failure to supply liability, spot market power extra expense, voluntary shutdown, system failure triggers for business interruption and contingent business interruption, and specific industrial control systems (ICS), SCADA, and other operational technology (OT) provisions were incorporated into highly manuscript policies. This tailored approach resulted in a decade which has seen the majority of Electric & Gas Utilities begin to purchase meaningful cyber insurance limits ($50M+) as part of their overall risk management programs.

Oil & Gas companies face increasing cyber threats that cannot be fully mitigated through technology alone. Cyber insurance provides financial protection and an injection of capital against operational disruptions, ransom demands, and regulatory penalties that are lawfully insurable. A comprehensive risk management approach that combines cybersecurity measures with insurance ensures resilience against evolving threats.

Evolving Threat Landscape and ICS Malware

Attacks targeting OT, especially those carried out with an intention to cause physical disruption, are much rarer than those targeting IT systems. That said, the Oil & Gas sector is a lucrative target for cybercriminals due to the money involved, especially for ransomware groups who understand the cost of downtime to such companies.

ICS vendor Waterfall Security Solutions identified 68 cyber-attacks in 2024 which caused physical consequences to OT – a significant increase over the previous year, though still less than the estimated thousands of cyber-attacks per day targeting IT systems.

Furthermore, Oil & Gas was among the top four industries targeted by ransomware in 2024, with 44 reported attacks, and threat actors refining ICS-specific malware:

• Nation-state actors are investing in ICS-specific malware (e.g., ELECTRUM, KAMACITE)
• Cybercriminals and hacktivists lowering the barrier for OT attacks
• ICS malware becoming more accessible through repurposed tools

Notably, the PIPEDREAM malware discovered by Dragos in 2022 remains a significant concern. Designed to target industrial controllers in Oil & Gas infrastructure, the malware’s capabilities include:

• Disabling safety controllers
• Manipulating PLCs
• Disrupting SCADA and control systems
• Bypassing network security measures

Attack Surface and Exposure

While many buyers in the past considered cyber insurance to be primarily a liability product (associated with the confidentiality and integrity of data), today’s cyber insurance has evolved into a first- and third-party product tailored to address the unique exposures and operations of specific sectors. The Oil & Gas industry relies on E&P, midstream, contract services, and transportation companies to keep operations running, but these critical sectors face significant cyber threats that can disrupt supply chains and impact the global economy.

Remote Operations and Access: Increasing reliance on remote operations and IoT devices in the drive for efficiency and real-time monitoring have introduced new cybersecurity challenges to the Oil & Gas industry. The use of remote access technologies increases the overall attack surface, creating potential entry points for threat actors to gain unauthorized access and the deployment of malware.

ICS Vulnerabilities: Vulnerabilities in ICS can have catastrophic consequences when misused, including equipment damage, environmental hazards, and even loss of life.

Supply Chain Risks: The interconnected nature of the Oil & Gas industry introduces weaknesses through third-party vendors and suppliers. A compromised supply chain can result in the introduction of malicious software or ransomware, leading to potential security breaches, unauthorized access to critical systems, data exfiltration, and potential disruption of operations.

Insider Threats: Disgruntled employees, contractors, or others who have been granted prior authorized access can intentionally or unintentionally compromise critical systems and sensitive data.

Joint Venture Vulnerabilities: An often-overlooked exposure across the industry is that introduced through joint ventures. Collaborative networks, shared resources, shared IT and OT systems, and joint operational data create potentially critical system weaknesses. Lack of proper network segmentation and security controls between joint venture partners can lead to unauthorized access to sensitive data, potential disruption of joint operations, and increased risk of cyber-attacks through partner networks.

Cyber Events Impacting Oil & Gas Companies

Ransomware attacks have become a significant threat to the industry. High-profile incidents demonstrate that even with sophisticated cybersecurity measures, adversaries can and will continue to successfully breach systems:

• Sector 16 and Z-Pentest Attack on Texas SCADA System (2025): Russian hacktivists gained unauthorized access to a U.S. Oil & Gas facility.
• Halliburton (2024): An oilfield services company experienced a cyber attack and the exfiltration of sensitive data requiring the organization to proactively take certain IT systems offline to contain the breach, disrupting access to critical business applications.
• Suncor Energy Cyber Attack (2023): Disrupted payment systems, resulting in millions of dollars in losses.
• Amsterdam-Rotterdam-Antwerp Storage Terminals (2022): Malware was deployed onto the automation systems that control the scheduling and execution of fuel transfers between storage tanks, pipelines, and transport vehicles, disrupting key terminal management systems.
• Colonial Pipeline Attack (2021): Led to widespread fuel shortages and a ransom payment of $4.4 million.
• ExxonMobil Ryuk Ransomware Attack (2019): Disrupted refining operations.
• Triconex Controller Attack at Saudi Aramco (2017): Targeted safety controllers, highlighting industrial vulnerabilities.

The energy industry as a whole is generally known to be particularly vulnerable to third-party attacks, and 67% of energy sector breaches are linked to initial infections through software and IT vendors, rather than the target themselves. Energy companies often have large attack surfaces, which are only growing as more companies utilize internet-connected devices. According to the 2025 Dragos’ Year In Review report, 65% of sites assessed had insecure remote access conditions, which is particularly concerning for offshore Oil & Gas operations that rely heavily on remote connections.

Cyber Insurance – Coverage Gaps and Solutions

When cyber exclusions are applied to property policies, there are gaps created in coverage related to resultant physical damage and business interruption loss, meaning that organizations are no longer protected if there is a physical loss or damage arising out of the use of computers or data. The extent to which these gaps exist is dependent on the language of the cyber exclusions applied and can range between absolute exclusions, which take out coverage for anything related to the use of computers or data (directly or indirectly), to exclusions that try to delineate between malicious cyber events and non-malicious or accidental events.

In every case, these cyber exclusions take away certainty of coverage for organizations, and an affirmative insurance policy covering physical damage loss and business interruption caused by cyber events (accidental or malicious) should be considered for risk transfer. The availability of cyber physical damage insurance policies for malicious events is prevalent. However, it remains unclear whether accidental events that cause physical damage should be covered by the property market or the cyber insurance market, with the former currently taking the majority of that exposure given that cyber events are considered fortuitous in nature similar to other physical perils, such as fire, explosion, wind etc.

Cyber property damage can be obtained in either the property market or the stand-alone cyber market with varying degrees of coverage clarity and certainty.

*LMA cyber exclusions exclude ‘cyber act’ and carveback certain perils arising from a ‘cyber incident’ depending on the exclusionary language used.

**Sometimes cyber property damage limits are aggregated with non-damage cyber limits if purchased under the same policy with the same insurers.