INDUSTRY FACT FILE · OIL, GAS & PETROCHEMICALS

Five New Case Studies in Oil and Gas Security

Original 2026 case studies, each written as a blog post, showing how current threats play out in oil, gas and petrochemicals and how Codec Networks services break the attack chain.

In this document 1.  About these case studies 2.  Case Study 1: The Pipeline That Stopped for an IT Attack 3.  Case Study 2: The Safety System Somebody Reprogrammed 4.  Case Study 3: The Contractor Laptop on the Refinery Network 5.  Case Study 4: The Fuel Station Network Payment Fraud 6.  Case Study 5: The Wiper on the Exploration Company's Network

These five case studies were written for this document set and have not been published elsewhere. Each is a composite scenario combining attack techniques and control failures widely observed in oil, gas and petrochemicals with the obligations that apply in India as of October 2026—in particular CERT-In's Directions and audit guidelines, NCIIPC expectations and PNGRB and OISD safety and integrity standards.

Important disclosure The organisations described are fictional and the scenarios are illustrative. They are not accounts of real incidents, and they are not Codec Networks client engagements or claims of achieved outcomes. Their value lies in showing how connected weaknesses form an attack chain, which controls break it, and which services test those controls.

Case study	Organisation type	Core threat	Regulatory lens	Primary bundles
1. The Pipeline That Stopped for an IT Attack	Product pipeline operator	IT ransomware forcing a precautionary shutdown	CERT-In; PNGRB; NCIIPC	B3, B7, B10
2. The Safety System Somebody Reprogrammed	Petrochemical complex	Targeting of a safety instrumented system	OISD; CERT-In; NCIIPC	B1, B7, B8
3. The Contractor Laptop on the Refinery Network	Refinery	Malware introduced during a turnaround	OISD; CERT-In; contracts	B9, B3, B7
4. The Fuel Station Network Payment Fraud	Fuel retailer	Compromised central station management	PCI DSS; DPDP; CERT-In	B2, B3, B7
5. The Wiper on the Exploration Company's Network	Exploration and production company	Destructive wiper malware	CERT-In; NCIIPC	B3, B7, B10

The control system was fine. The company shut down anyway.

At a glance
Organisation	A product pipeline operator (“Pipeco A”) supplying fuel to several states
Threat	Ransomware encrypting billing and scheduling systems on corporate IT
Why it is new	Hidden OT dependencies on IT can stop operations
Codec Networks services	Dependency mapping and segmentation, SOC, crisis exercises (Bundles B3, B7, B10)

The scenario

Ransomware encrypted Pipeco A's billing, scheduling and corporate systems.

Pipeline SCADA was not encrypted, but Pipeco A could not bill, schedule or confirm custody transfer, and was unsure whether OT was safe.

Pipeco A shut down the pipeline as a precaution, disrupting fuel supply until systems were restored.

Figure 8: Illustrative attack path for Case Study 1 and the controls that break it.

What went wrong

• OT's dependencies on IT were unmapped.
• IT/OT boundaries were not clearly enforced.
• No plan to operate OT without IT.
• Crisis decisions had never been rehearsed.

The impact

Pipeco A faced supply disruption, public scrutiny, reporting obligations and recovery costs.

The regulatory lens

• CERT-In Directions: incidents reported within six hours.
• PNGRB: supply and integrity obligations for pipelines.
• NCIIPC: coordination where systems are notified as critical information infrastructure.

How Codec Networks would help

Need	Codec Networks response	Bundle
Map and separate	OT dependency mapping and segmentation	B3
Detect early	24x7 IT/OT SOC	B7
Rehearse decisions	Crisis exercises with operations	B10

Key lessons Map OT's dependencies on IT. Enforce IT/OT boundaries. Plan to run OT without IT. Rehearse shutdown decisions.

The plant tripped safely. Investigators found it wasn't an accident.

At a glance
Organisation	A petrochemical complex (“Chemco B”)
Threat	Attackers reaching an SIS engineering workstation and uploading malicious logic
Why it is new	Safety systems are the last line of defence
Codec Networks services	SIS security review, OT monitoring, OT forensics (Bundles B1, B7, B8)

The scenario

Attackers gained a foothold in Chemco B's IT network and moved into the engineering network.

They reached a workstation used to program safety controllers, which had been left in a mode that allowed changes.

Malicious logic caused a fault that tripped a unit to a safe state. Investigation revealed deliberate targeting of safety systems.

Figure 9: Illustrative attack path for Case Study 2 and the controls that break it.

What went wrong

• SIS engineering workstations were reachable from other networks.
• Controllers were left in program mode.
• Engineering activity was not monitored.
• No OT threat hunting.

The impact

Chemco B lost production, launched a safety investigation and rebuilt its safety system security model.

The regulatory lens

• OISD standards: safety of installations and process safety management.
• CERT-In Directions: incidents reported within six hours.
• NCIIPC: coordination for critical infrastructure.

How Codec Networks would help

Need	Codec Networks response	Bundle
Protect the SIS	SIS isolation and key-switch review	B1
Watch engineering	Engineering workstation monitoring	B7
Investigate	OT-aware forensics	B8

Key lessons Isolate safety systems. Keep controllers in run mode. Monitor engineering workstations. Hunt for OT intruders.

Five hundred contractors arrived. So did one infected laptop.

At a glance
Organisation	A refinery (“Refinery C”) during a planned turnaround
Threat	Self-spreading malware on a contractor laptop reaching operator stations
Why it is new	Turnarounds bring many uncontrolled devices into plants
Codec Networks services	Third-party access programme, segmentation, OT monitoring (Bundles B9, B3, B7)

The scenario

During a turnaround, contractor engineers connected laptops to plant networks for configuration work.

One laptop carried self-spreading malware that reached operator stations and historians.

Units were slowed while systems were cleaned, extending the turnaround and increasing costs.

Figure 10: Illustrative attack path for Case Study 3 and the controls that break it.

What went wrong

• Contractor devices were not scanned.
• No segmented temporary access for contractors.
• OT endpoints lacked protection.
• Contractor accounts were not tracked.

The impact

Refinery C faced delays, cost overruns and a review of contractor security requirements.

The regulatory lens

• OISD standards: safe operation of installations during maintenance.
• CERT-In Directions: incidents reported within six hours.
• Contracts: contractor security obligations.

How Codec Networks would help

Need	Codec Networks response	Bundle
Control contractors	Third-party access programme and device scanning	B9
Segment access	Temporary, segmented turnaround networks	B3
Watch OT	OT endpoint and network monitoring	B7

Key lessons Scan every contractor device. Give contractors segmented access. Protect OT endpoints. Track and remove contractor accounts.

Prices changed at hundreds of outlets. Nobody at head office had changed them.

At a glance
Organisation	A fuel retailer (“Fuelco D”) managing outlets centrally
Threat	Stolen remote-management credentials used to alter station settings
Why it is new	Central management concentrates control of many outlets
Codec Networks services	Retail system testing, remote access hardening, monitoring (Bundles B2, B3, B7)

The scenario

Fuelco D managed station automation and payment settings from a central platform.

An attacker stole a support engineer's credentials—without MFA—and changed pricing and payment configurations at many outlets.

Fraudulent transactions and pricing errors followed before the changes were spotted.

Figure 11: Illustrative attack path for Case Study 4 and the controls that break it.

What went wrong

• No MFA on central management.
• Configuration changes were not monitored.
• Retail systems were not tested.
• Payment security was not aligned to PCI DSS.

The impact

Fuelco D lost revenue, faced payment network scrutiny and customer complaints.

The regulatory lens

• PCI DSS: security of card payment environments.
• DPDP Act and Rules: customer data safeguards once provisions commence.
• CERT-In Directions: incidents reported within six hours.

How Codec Networks would help

Need	Codec Networks response	Bundle
Test retail systems	Station automation and payment testing	B2
Harden access	Remote management and MFA review	B3
Watch changes	Monitoring of price and configuration changes	B7

Key lessons Enforce MFA on central management. Monitor price and configuration changes. Test station automation. Align payments with PCI DSS.

Thousands of screens went dark on the same morning.

At a glance
Organisation	An E&P company (“Upco E”) with large seismic and engineering datasets
Threat	Spear-phishing leading to domain admin compromise and mass wiping
Why it is new	Destructive attacks aim for maximum damage, not ransom
Codec Networks services	PAM and backups, SOC, recovery exercises (Bundles B3, B7, B10)

The scenario

A spear-phishing email compromised an Upco E employee, and attackers escalated to domain administrator.

They deployed wiper malware that destroyed data on thousands of workstations and servers.

Seismic and engineering data were unavailable, and Upco E spent months rebuilding.

Figure 12: Illustrative attack path for Case Study 5 and the controls that break it.

What went wrong

• Privileged access was not tiered.
• Critical datasets lacked offline backups.
• EDR alerts were not monitored 24x7.
• Rebuild had never been rehearsed.

The impact

Upco E lost productivity and data, reported the incident and rebuilt its identity and backup architecture.

The regulatory lens

• CERT-In Directions: incidents reported within six hours.
• NCIIPC: coordination where systems are notified as critical.
• Partners: obligations to joint-venture partners for shared data.

How Codec Networks would help

Need	Codec Networks response	Bundle
Protect privilege	PAM and tiered admin review, offline backups	B3
Detect early	24x7 SOC with EDR and hunting	B7
Rehearse rebuild	Destructive-malware recovery exercises	B10

Key lessons Tier privileged access. Keep offline backups of critical data. Monitor endpoints 24x7. Rehearse rebuilding.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com