Conpet kept oil moving while ransomware disrupted its business network, showing how architecture and preparation can keep an IT breach from becoming a pipeline outage.
In February 2026, a cyberattack disrupted the business IT infrastructure of Romanian oil pipeline operator Conpet, knocking its website offline. As you might expect, keeping the pipeline flowing was the first priority. Despite the attack, the company kept its supervisory control and data acquisition (SCADA) and telecommunications systems operational.
Conpet reported crude oil and gasoline transport continued normally after the attack, filing a criminal complaint and working with Romanian cybersecurity authorities to investigate the incident and restore affected infrastructure.
The company later confirmed data had been removed from its network. The Qilin ransomware group claimed to have stolen nearly one terabyte and published 16 sample images including financial records, passport scans and other personal information. Conpet did not confirm the volume of stolen data.
The incident, however, produced the outcome pipeline operators want: business systems were impaired without interrupting physical operations.
Treat “SCADA Unaffected” as an outcome, not proof of security
“Conpet's statement establishes an outcome, not a cause,” says Collin Hogue-Spears, senior director of solution management at Black Duck. “No public evidence shows which control, including segmentation, spared SCADA.” The attackers may have encountered a hardened boundary, chosen not to pursue operational technology (OT), or stopped after obtaining enough data for extortion or doxxing.
With that in mind, security teams should avoid presenting Conpet as proof that a particular architecture worked. Instead, they can review the evidence, including firewall logs showing rejected traffic toward OT and authentication records showing that corporate credentials couldn’t access control systems. Other evidence includes jump-host records from the heavily secured intermediary systems used to access control environments, covering remote sessions and monitoring that would reveal scans of SCADA address ranges or attempts to reach engineering workstations.
In a similar situation, operators should test those controls by assuming the enterprise network and its identity system are already compromised. An architecture diagram may show separation, but firewall rules, routing paths and live traffic determine whether the boundary exists in practice. “A boundary in the configuration is a claim,” Hogue-Spears says. “A boundary in the logs is evidence.”
Separate identity, control the conduits
An industrial screened subnet (often called an industrial DMZ) should sit between corporate IT and the control network, with connections denied unless an operational requirement explicitly permits them. NIST guidance recommends grouping OT assets into levels, tiers or zones and allowing only authorized communications between them.
Identity requires the same separation. For example, a compromised corporate administrator account shouldn’t grant access to SCADA, pipeline communications or engineering workstations. “Strictly in order of priority, the identity comes first,” says Agnidipta Sarkar, chief evangelist at ColorTokens.
Sarkar recommends eliminating trust between IT and OT identity domains, using phishing-resistant authentication and permitting only required protocols through each conduit. Remote sessions should pass through hardened jump servers or privileged-access workstations with time-limited authorization and session recording, rather than a direct VPN connection from IT into OT.
Vendor maintenance requires the same discipline: restrict access to the assigned zone and approved work period, use one-time or just-in-time credentials, and prevent vendors from moving into unrelated operational areas. In addition, management of the SCADA wide-area network should remain separate from the corporate WAN.
Keep operations running when IT is contained
Even so, SCADA isolation alone doesn’t guarantee continuity. Pipeline operations may depend on enterprise identity, billing, dispatch, virtualization, communications and other supporting services. Losing one of those dependencies can force operators to stop transportation even when controllers remain uncompromised.
An attack on Colonial Pipeline in 2021 demonstrated that risk. The company disconnected systems that monitored and controlled physical pipeline functions to prevent ransomware from reaching them. Investigators found no indication that those systems had been breached, but the precaution still halted pipeline operations.
Operators need a dependency register showing which enterprise services support transportation, how long operations can continue without them, and what alternatives are available. Incident plans should also preassign who can authorize network isolation, continued transport, manual operation or a controlled shutdown.
“Even if the enterprise network is fully compromised, proper microsegmentation and zoning must ensure immediate quarantine of the cyberattack to prevent operational shutdown of physical processes,” Sarkar says. That kind of quarantine only holds up after an exercise tests it. Can responders isolate an infected business segment without severing operator communications or essential telemetry? When teams cut too broad a swath of the network to contain a breach, they risk creating the operational halt the precaution was meant to prevent.
Deciding what to isolate requires two distinct areas of technical knowledge. Responders must understand industrial protocols like Modbus TCP, Distributed Network Protocol 3 (DNP3) and Open Platform Communications Unified Architecture (OPC UA) to track adversary activity. At the same time, pipeline engineers should evaluate hydraulic transients, overpressure conditions, leak-detection logic and safe operating states to protect physical systems. Neither group can make that determination alone, and both assessments need to happen before leadership can know whether physical transport is truly secure.
Protect data even when SCADA stays online
Keeping physical operations running leaves attackers another source of leverage. Conpet confirmed exfiltration, while Qilin used its unverified theft claim and published samples to increase pressure through potential privacy, fraud and reputational harm. “When the pipeline keeps pumping, extortion pressure shifts from encryption to exposure,” Hogue-Spears cautions.
Egress monitoring catches what encryption-focused defenses miss: bulk outbound transfers, archives appearing where none belong, connections opening to external storage. Logs must exist at the network and application layers because investigators can’t reconstruct data theft that was never recorded.
The response plan should identify which data owners, legal teams, regulators and national cybersecurity authorities must be notified and who has authority to make those decisions. Continuity planning must protect both the physical process and the information attackers can use for extortion. “Continuity answers encryption,” Hogue-Spears says. “Only data custody answers exposure.”
The targeting of Conpet shows how separating corporate IT from OT systems can preserve physical operations during a ransomware attack, and also underscores why continuity also requires protecting sensitive data. Today’s security professionals require practical knowledge of OT segmentation, separate identity domains, controlled network conduits and recovery planning.
The missing role between IT and OT
Replay the Conpet timeline and a harder question surfaces: who on an incident response team can actually verify that the boundary held before leadership issues a public statement?
A security team trained for OT treats the architecture diagram as a hypothesis. They examine the firewall logs, check whether corporate credentials ever authenticated against control systems, and verify that jump-host records account for every active remote session. That work has to happen before an incident, and it is what turns "SCADA unaffected" into an operational reality that withstands regulatory scrutiny.
The same training changes how organizations handle isolation decisions under pressure. Colonial Pipeline halted transportation because leadership couldn’t rule out exposure quickly enough to justify keeping fuel moving. An incident responder who reads Modbus TCP or DNP3 traffic, and who understands how enterprise scheduling feeds pipeline dispatch, can determine whether severing a network link stops the adversary or stops the physical process. Making that call takes minutes, and getting it wrong shuts down operations just as effectively as the malware would.
Most enterprise security programs lack a clear owner for that decision. Enterprise SOC analysts understand network telemetry but rarely touch industrial protocols. Control engineers manage physical safety and continuous uptime, yet they aren’t trained to anticipate adversary tradecraft. The boundary sits in the handoff between two teams that speak different languages. A CompTIA analysis of Lightcast job posting data showed US employers listed more than 180,000 positions across OT roles in 2024, highlighting how few professionals currently bridge that gap. The new CompTIA SecOT+ certification validates OT risk assessment, architecture, threat analysis and industrial incident response skills for professionals working across that critical boundary.