Saudi Aramco confirms data leak

State-controlled oil firm Saudi Aramco said some of its data has been leaked via a contractor. But the company has not confirmed reports that the information is being used in a cyber-extortion attempt.

The firm said it "recently became aware of the indirect release of a limited amount of company data which was held by third party contractors". Aramco has not named the contractor and has not specified how the leak occurred.

"We confirm that the release of data was not due to a breach of our systems, has no impact on our operations, and the company continues to maintain a robust cybersecurity posture," it said.

Aramco's statement follows reports that someone claiming to have stolen 1 terabyte of the company's data had demanded a $50mn ransom in cryptocurrency via a post on the dark web.

Cybersecurity has become a hot topic for oil and gas companies after a ransomware attack on the US Colonial Pipeline caused widespread disruption to fuel supplies across the US Atlantic coast earlier this year. Unlike the Colonial incident, Aramco's data leak does not appear to involve the use of malware.

Aramco has strengthened its cybersecurity since being hit by the so-called Shamoon computer virus in 2012, which forced it to destroy 30,000 of its computers.

By Samira Kawar