Risk Awareness · Security Incidents

Security incidents

Some incidents target the sites a service depends on.

Some incidents target the sites a service depends on.

Attacks on energy, industrial and transport sites can take a key facility out at once, and the effects reach well beyond the site. The examples below are reported by public sources and are kept factual, with no comment on who was responsible.

For continuity the useful questions are practical: what depends on one site, what stands in as a back-up, and how people are kept safe and informed.

All themes are on the Risk Awareness overview. New to the subject? Read What is Business Continuity?

Examples from the region.

September 2019Abqaiq and Khurais, Saudi ArabiaAttack on energy infrastructure

Oil processing sites hit by missiles and drones

On 14 September 2019 an attack using missiles and drones hit Saudi Aramco’s Abqaiq oil processing facility and the Khurais oil field and processing plant. The US Congressional Research Service reported that about 5.7 million barrels a day of production was temporarily disrupted, over half of Saudi Arabia’s output and about 5 per cent of global supply. Aramco was reported to be drawing on stored oil and spare capacity to meet export commitments while production was restored.

What it means for continuityA few critical sites can carry a very large share of an operation. Storage, spare capacity and a tested restoration plan are what let an organisation keep meeting commitments while a key site is out.

Source: Congressional Research Service, “Abqaiq Facility”, 2019

January 2022Abu Dhabi, United Arab EmiratesAttack on industrial and transport infrastructure

Drone attacks affect an industrial area and the airport

On 17 January 2022 drone attacks affected the Musaffah industrial area and Abu Dhabi International Airport. UN News, citing news agencies, reported a drone attack targeting an oil facility in the capital and a fire at the airport. The UN Secretary-General condemned the attacks and recalled that attacks on civilian infrastructure are prohibited under international humanitarian law.

What it means for continuityIndustrial sites, transport hubs and the people who use them can be affected at the same time. Emergency response arrangements, staff safety communications and alternative sites for critical work are worth having in place well before an event like this.

Source: UN News, 17 January 2022

Examples from elsewhere.

December 2018Gatwick Airport, England, UKDrone sightings at an airport

Drone sightings close the Gatwick runway

The BBC reported that the Gatwick runway was shut from just after 21:00 on Wednesday 19 December 2018, when two drones were spotted flying over the perimeter fence, and that it was still shut on 20 December after repeated sightings. About 110,000 passengers on 760 flights were due to fly on the Thursday. Incoming flights were diverted to other airports, and about 11,000 people were reported to be at the airport. Sussex Police described it as a deliberate act of disruption and said it was not terror-related. The Civil Aviation Authority considered it an extraordinary circumstance.

What it means for continuityOne runway can carry a whole airport, and a closure can last until it is judged safe to reopen. Airports, airlines and their suppliers can plan for diversions, for looking after stranded passengers and for clear, frequent updates, because the closure time cannot be predicted.

Source: BBC News, 20 December 2018

September 2022Baltic Sea, near Bornholm, DenmarkDamage to energy pipelines

Four leaks are found on the Nord Stream pipelines

Security Council Report records that between 26 and 29 September 2022 four leaks were detected in the Nord Stream 1 and Nord Stream 2 gas pipelines near the Danish island of Bornholm, in international waters within the economic zones of Denmark and Sweden. In a letter to the UN Security Council, Denmark, Germany and Sweden said their investigations established that powerful explosions had caused the damage. Denmark and Sweden later closed their investigations, and Germany’s was still continuing at the time of the October 2024 briefing. This page makes no comment on responsibility.

What it means for continuityLong energy links under the sea or across open ground are hard to watch and slow to repair. Organisations that depend on one supply route can look at what stands behind it, such as stored supply, other routes and the order in which customers or processes would be served.

Source: Security Council Report, 3 October 2024

December 2022Moore County, North Carolina, USADamage to electricity substations

Gunfire damages substations and cuts power to a county

NPR reported that a mass power outage began shortly after 7 p.m. on Saturday 3 December 2022 in Moore County, after multiple power substations were damaged in what authorities described as intentional vandalism. The county was placed under a state of emergency and a night-time curfew, schools were closed on the Monday, and a sports complex was used as a shelter. Nearly 40,000 customers were still without power on the Sunday evening, and the utility said the repair needed new equipment and could take until Thursday.

What it means for continuityDamage to a few substations can switch off a whole area, and replacing specialist equipment takes days. Planning for a multi-day power loss covers backup power, shelter and care for staff and customers, and how an organisation keeps communicating while the grid is down.

Source: NPR, 4 December 2022

December 2024Gulf of Finland, between Finland and EstoniaSubsea power cable failure

Estlink 2 power cable between Finland and Estonia fails

The Guardian reported that on 25 December 2024 current on the EstLink 2 undersea cable carrying electricity from Finland to Estonia was cut at 12:26 local time, according to the grid operator Fingrid. Finland’s prime minister said the outage had not affected the country’s electricity supplies and that the authorities were investigating. A Finnish grid official said sabotage could not be ruled out. The Guardian described it as the latest in a series of incidents involving cables and energy pipelines in the Baltic Sea. The cause was not established in the report.

What it means for continuityA link between two countries can fail without warning, and the cause may take time to establish. Knowing which supplies depend on one link, and how much alternative capacity exists, helps organisations judge whether a failure will reach them.

Source: The Guardian (AFP), 25 December 2024

Two regional examples and four from elsewhere.

The examples are selected for awareness and are not a complete record. For incidents of other kinds, see the Risk Awareness overview.

Read on.

Operational Resilience

Trace what each important service depends on.

Business Continuity Exercises

Test decisions and communications.

What is Operational Risk?

Where operational risk comes from.

Where this page comes from.

This page is ADVOX’s own summary, written in its own words. The sources remain the reference. The examples are public events, included for awareness. ADVOX was not involved in any of them. ADVOX is not affiliated with or endorsed by the organisations named as sources. It is general information, not legal, regulatory or professional advice. Copyright in the sources named above belongs to their owners.

Talk to ADVOX about keeping critical sites and services running.

We aim to reply to your enquiry within 2 hours.

Built with Symphony.co