German oil terminals, tank farms operating at 'limited capacity' after cyber attack

Some German oil terminals and storage sites were operating at limited capacity following a Jan. 29 cyber attack targeting energy company Mabanaft Group and storage company Oiltanking Group, both said Feb. 1.

The incident has affected supply of some oil products in Germany, Europe's biggest oil consumer, trading sources told S&P Global Platts.

Oiltanking Deutschland said it had declared force majeure at its 11 German terminals, all of which were operating at "limited capacity".

Mabanaft Deutschland also said it had declared force majeure for the majority of its inland supply activities in Germany.

The two companies said in a joint statement they had been the victim of a cyber attack on Jan. 29 that had affected their IT systems.

"All parties continue to work to restore operations to normal in all our terminals as soon as possible," the companies said.

Supply delays

Traders said the incident had resulted in many tankers being unable to load, as the loading and unloading at the tank farms was largely an automated process.

Many of German's oil suppliers had been affected, though the impact had not been "major" yet, one German-based oil products trader said.

"Some say this might last 7-14 days or they might just pay off the blackmailers," the trader said. "It is a hiccup but not that big of a deal [yet]."

Some suppliers have been affected, especially in Hamburg, he said.

Oiltanking Deutschland operates 11 terminals in Germany - Endorf, Berlin, Duisburg, Frankfurt Am Main, Gera, Hamburg-Blumensand, Hamburg-Waltershof, Hamm, Hanau, Karlsruhe and Rheinau-Honau. The 11 terminals have a total storage capacity of 2.375 million cu m and total throughput at the terminals in 2020 was 18.2 million mt, according to its website.

Mabanaft is a key suppliers of oil products such as heating oil, diesel, jet fuel, gasoline and other oil products in Germany and the neighboring Amsterdam-Rotterdam-Antwerp area.

Cyber attacks on rise

The incidents, largely in the form of breaches to computer systems, have emerged as a growing threat to commodity supply chains and companies are starting to prioritize cyber security.

"Given the potential fragility of the fuel supply chain -- as highlighted by recent shortages in the UK -- disruptive cyber attacks can cause widespread disruption for consumers and businesses," Huntsman Security Head of Product Management Piers Wilson said.

"With luck the attack on Oiltanking won't see widespread disruption in Germany, but it must be seen as a wake-up call to organizations that still are not 100% confident in their own and their partners' cyber defenses," Wilson said.

According to data compiled by Platts, there have been more than 20 cyber security incidents over the past two years targeting companies operating in commodity markets from energy to metals.

In May 2021, the Colonial Pipeline in the US -- the largest pipeline system for refined oil products halted all operations because of a cyber attack involving ransomware.

The line was the primary artery for gasoline and refined products for much of the US Gulf Coast and Atlantic Coast delivering more than 100 million gal/d of fuel and heating oil.