Suncor swaps out laptops after cybersecurity incident as energy sector takes stock of risks

Suncor is replacing employee computers after a cybersecurity incident last week shut down debit and credit processing at Petro-Canada gas stations across the country, among a series of other security measures at the Calgary-based company.

An internal communication dated July 3, viewed by CBC News, says the company will replace desktop and laptop computers in waves to ensure the devices are safe to use, starting with "a small number of employees and contractors aligned with business criticality."

It's not clear from the memo what the scope of the computer recall is or what departments were affected, but one expert said that if the recall is extensive, it would be an indication of a serious situation.

"Normally you wouldn't expect hardware to be compromised so fully that you need to replace everything," said cybersecurity expert Chester Wisniewski, who is field chief technology officer at the international cybersecurity firm Sophos.

CBC News asked Suncor if it planned to replace all computers across the company, or just in certain departments, but did not receive a response. 

Among other things, Suncor employees have also been told in recent days not to use social media on company devices or let people tailgate behind them into an elevator. 

The company has stayed mum about the cause of last week's attack, which affected debit and credit transactions at gas stations across the country and restricted customers' access to the Petro-Points loyalty program. 

While the public-facing nature of the Suncor incident has made cybersecurity a hot topic, cyber threats have been a growing concern for years across the country, especially within the oil and gas sector. 

According to Statistics Canada survey data, in 2019 about a quarter of Canadian organizations classified as oil and gas had reported a cyber incident — the highest of any infrastructure sector, according to a report from the Canadian Centre for Cyber Security released just days before the Suncor incident. 

As of Wednesday, customers were still complaining to Petro-Canada on Twitter about the Petro-Points app not working, an issue the company has said it's "working hard to resolve." 

The outage is expected to cost the company "millions of dollars" before it's fully resolved, according to an early estimate from the Canadian Internet Registration Authority. 

The hit to the business includes the direct loss of gas station sales during the peak of the outage, though there will also be impacts that aren't as immediately apparent, said Geoffrey Cann, a former Deloitte partner and energy industry consultant.

The brand's reputation will have taken a hit from having dedicated Petro-Can customers locked out of their loyalty program, he said.

There may also be the operational headache of dealing with the logistics of storing or selling oil that was still being refined while sales at Petro-Can locations were down, he said.