Shamoon (Saudi Aramco, 2012)
A wiper attack that destroyed in 2012 the data on about thirty thousand workstations at the Saudi oil company, attributed to Iran; the first major computer sabotage of a company by a state.
On 15 August 2012, malware called Shamoon wiped the hard drives of about thirty thousand workstations at Saudi Aramco, the Saudi national oil company, displaying instead an image of a burning American flag. Oil production was not affected, industrial systems being separate, but the company had to rebuild most of its business IT and fall back on paper procedures for weeks. A few days later, the same malware hit a Qatari gas producer. US officials attributed the operation to Iran, in a context of regional rivalry and after the discovery of Stuxnet, aimed at Iran's nuclear program. Variants struck Gulf companies again in 2016 and 2018. For insurance, Shamoon marked the shift from cyber as data theft to cyber as asset destruction. It showed a state's interest in hitting a company rather than an administration, to reach an economic rival without military action. It raised, well before NotPetya, the question of the war exclusion for a state attack on a company, in a country not in declared armed conflict. And it revealed a hardware dependency: the mass replacement of hard drives was enough to tighten the global market for the component.
On October 11, 2012 in New York, US Defense Secretary Leon Panetta described the attack on Saudi Aramco as probably the most destructive the private sector had seen to date, citing more than 30,000 computers rendered useless.
Shamoon, Saudi Aramco attack, Disttrack
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.