Cyber Attacks

An attack on IT is an attack on the service that depends on it.

When systems are locked, wiped or taken offline, the work stops even if buildings and people are fine. The examples below show attacks on a health service, a pipeline operator, shipping and energy services, and what each one meant for continuity.

The subject is large. This page gives a plain overview and links to ADVOX’s two cyber pages for more.

Five common ways an attack stops work.

Attacks take many forms. These five come up most often in continuity planning, described here in general terms. Most real incidents combine more than one.

Ransomware

Files or systems are locked, and access is offered back only against payment. Work that depends on those systems stops until they are restored or rebuilt.

Destructive malware

Software that damages or wipes systems, with no real route to getting data back by paying. Recovery then depends on clean backups and a practised rebuild.

Overload attacks

A service is flooded with traffic so that customers and staff cannot reach it. The systems may be intact, but the service is unavailable.

Data theft

Information is taken, often to be published or sold. The disruption is as much about trust, notification duties and communications as about IT.

Phishing

A message that looks genuine persuades someone to open a file, share a password or approve a payment. It is often the first step of a larger incident.

What organisations commonly do first.

Every incident is different, and specialist help matters. These steps are general practice, and the examples below show several of them: Colonial Pipeline disconnected the systems that control its pipeline, the NHS review found communications failing, and CISA advises reporting to law enforcement.

Contain it

Disconnect affected systems where possible so the problem does not spread, and close the gap that was used.

Find out what was touched

Work out which systems and which data are affected, and keep a clear line between what is known and what is only assumed.

Understand the impact

Judge what the loss or publication of the data, or the loss of the system, means for customers, services and legal duties.

Communicate

Tell staff, customers and partners what is happening, what to do and when to expect an update. Report the incident to the police or the relevant authority.

CISA's guidance on the NotPetya incident, linked in the sources below, recommends regular, tested backups as part of a disaster recovery plan, and a security incident response and business continuity plan. ADVOX supports this work through Cyber Threats & IT Service Continuity and Business Continuity Exercises. For a plain introduction, read What is Cyber Security?

Examples from the region.

December 2018Middle East, India, Aberdeen and ItalyCyber attack with data-wiping malware

Shamoon variant hits an energy services company

On 12 December 2018 the Italian energy services company Saipem reported that a cyber attack had hit servers based in the Middle East, India, Aberdeen and, in a limited way, Italy, using a variant of Shamoon malware. The company said the attack led to the cancellation of data and infrastructures, and that it was restoring operations gradually through its back-up infrastructure.

What it means for continuitySome attacks are built to destroy data, not to ask for payment. Backups kept apart from the main network, and a practised restoration order for systems, decide how quickly operations return.

Source: Saipem press release, 12 December 2018

Examples from elsewhere.

May 2017England, UK, and worldwideRansomware

WannaCry ransomware and the NHS

On 12 May 2017 the WannaCry ransomware was released worldwide. The UK National Audit Office reports that at least 81 of 236 trusts in England were affected, that 6,912 appointments were cancelled in the first week with over 19,000 estimated in total, and that five areas had to divert patients from accident and emergency departments.

What it means for continuityThe NAO found the response plan had not been tested locally, so it was not immediately clear who should lead, and many sites could not use email. Staff shared information by telephone and personal mobile devices. Exercising plans and agreeing a back-up way to communicate are low-cost ways to prepare.

Source: National Audit Office, 27 October 2017

June 2017Ukraine and worldwideDestructive malware

NotPetya spreads across sectors

On 27 June 2017 a malware variant called NotPetya affected organisations in multiple countries, including in finance, transportation, energy, commercial facilities and healthcare. CISA reports that it encrypted files and the master boot record, making infected Windows computers unusable, and that it behaved more like destructive malware than ransomware. It was delivered through an update to Ukrainian tax accounting software.

What it means for continuityA trusted supplier’s software can be the route in. CISA’s advice includes regular, tested backups as part of a disaster recovery plan, and a security incident response and business continuity plan. Restoring from a known clean backup should be the plan, not a hope.

Source: CISA alert TA17-181A, revised 15 February 2018

May 2021South-eastern United StatesRansomware and energy supply

Colonial Pipeline halts fuel deliveries

On 7 May 2021 Colonial Pipeline Company learned it was the victim of a ransomware attack on its business systems. The GAO reports that, to protect the pipeline, the company proactively disconnected the systems that monitor and control physical pipeline functions, which temporarily halted all pipeline operations. It restarted on 13 May and deliveries resumed to all markets.

What it means for continuityBusiness systems and operating systems are linked, and a cyber incident in one can lead to a decision to stop the other. Knowing in advance what can be isolated, and how to run or bridge the service while it is, makes that decision easier to take.

Source: U.S. Government Accountability Office, 18 May 2021

Where this page comes from.

Source: Saipem, “Saipem: update on the cyber attack suffered”, 12 December 2018, read on 25 October 2026.

Source: National Audit Office (UK), “Investigation: WannaCry cyber attack and the NHS”, 27 October 2017, read on 25 October 2026.

Source: CISA (US Cybersecurity and Infrastructure Security Agency), “Petya Ransomware, alert TA17-181A”, revised 15 February 2018, read on 25 October 2026.

Source: U.S. Government Accountability Office, “Colonial Pipeline Cyberattack Highlights Need for Better Federal and Private-Sector Preparedness”, 18 May 2021, read on 25 October 2026.

This page is ADVOX’s own summary, written in its own words. The sources remain the reference. The examples are public events, included for awareness. ADVOX was not involved in any of them. ADVOX is not affiliated with or endorsed by the organisations named as sources. It is general information, not legal, regulatory or professional advice. Copyright in the sources named above belongs to their owners.