On Aug. 21, Halliburton, which is a global oil services company with operations in Anchorage for Alaska’s North Slope, was the victim of a cyber attack on its computer systems. The company filed a notification with the Securities and Exchange Commission about the incident, which forced it to take its system offline for an undisclosed period of time.
“When the Company learned of the issue, the Company activated its cybersecurity response plan and launched an investigation internally with the support of external advisors to assess and remediate the unauthorized activity. The Company’s response efforts included proactively taking certain systems offline to help protect them and notifying law enforcement. The Company’s ongoing investigation and response include restoration of its systems and assessment of materiality,” the company reported.
Although some tech writers said it was a ransomware attack, Halliburton did not reveal if this was that or a virus, nor did it say if it knows the identity of the hacker(s). The Federal Bureau of Investigations has recently warned that Iran is planning cyberattacks to disrupt the 2024 elections.
Halliburton only said, “The Company is communicating with its customers and other stakeholders. The Company is following its process-based safety standards for ongoing operations under the Halliburton Management System, and is working to identify any effects of the incident.”
The attack affected business operations at Halliburton’s north Houston campus and some of Halliburton’s global connectivity networks. Employees were told to not connect to the network. On Thursday, employees were told they could log back into the system again. But the SAP system, which provides collaboration functionality between Halliburton and suppliers, was still down.
Five days earlier, the Office of the Director of National Intelligence, the Federal Bureau of Investigation, and the Cybersecurity and Infrastructure Security Agency released the following statement:
“As each of us has indicated in prior public statements, Iran seeks to stoke discord and undermine confidence in our democratic institutions. Iran has furthermore demonstrated a longstanding interest in exploiting societal tensions through various means, including through the use of cyber operations to attempt to gain access to sensitive information related to U.S. elections. In addition to these sustained efforts to complicate the ability of any U.S. administration to pursue a foreign policy at odds with Iran’s interests, the Intelligence Community (IC) has previously reported that Iran perceives this year’s elections to be particularly consequential in terms of the impact they could have on its national security interests, increasing Tehran’s inclination to try to shape the outcome. We have observed increasingly aggressive Iranian activity during this election cycle, specifically involving influence operations targeting the American public and cyber operations targeting presidential campaigns.
“This includes the recently reported activities to compromise former President Trump’s campaign, which the IC attributes to Iran. The IC is confident that the Iranians have through social engineering and other efforts sought access to individuals with direct access to the presidential campaigns of both political parties. Such activity, including thefts and disclosures, are intended to influence the U.S. election process. It is important to note that this approach is not new. Iran and Russia have employed these tactics not only in the United States during this and prior federal election cycles but also in other countries around the world.
“Protecting the integrity of our elections from foreign influence or interference is our priority. As the lead for threat response, the FBI has been tracking this activity, has been in contact with the victims, and will continue to investigate and gather information in order to pursue and disrupt the threat actors responsible. We will not tolerate foreign efforts to influence or interfere with our elections, including the targeting of American political campaigns. As an interagency, we are working closely with our public and private sector partners to share information, bolster security, and identify and disrupt any threats. Just as this activity demonstrates the Iranians’ increased intent to exploit our online platforms in support of their objectives, it also demonstrates the need to increase the resilience of those platforms. Using strong passwords and only official email accounts for official business, updating software, avoiding clicking on links or opening attachments from suspicious emails before confirming their authenticity with the sender, and turning on multi-factor authentication will drastically improve online security and safety.”
