Payment problems in Petro-Canada continue, but the company says it is “making progress” with the solution

Petro-Canada says the nearly week-long issues customers have been experiencing with things like payment and loyalty programs at the gas station chain are ongoing, but it is making progress in resolving them.

The company’s troubles began about a week ago, when reports suggested on Friday that parent company Suncor had been hacked. Over the weekend, Suncor acknowledged it had experienced a “cybersecurity incident” and stressed that while it was confident no customer or employee data had been stolen, “some transactions with customers and suppliers may be affected.”

One of the first places to see such disruptions was in Petro-Canada, where the chain of more than 1,500 locations across the country was having trouble processing debit and credit payments. Other services, such as the Petro-Points loyalty program app and a car wash service, have also been affected.

Petro-Canada said on Twitter that it is “making progress in resolving the disruptions customers have experienced and will continue to update you as more services come back online.

“We apologize for any inconvenience this has caused, and thank you for your patience.”

LOOK | Customers confused and worried by outage:

Refueling customers told CBC News that the incident was inconvenient, but also concerning.

Ella Lee-O’Rourke tried to fill up at a station in Toronto this week and wanted to pay by card, but had to cut back to just $20 because she happened to be carrying a cash account.

“No one carries cash,” she said. “I probably won’t be coming here for a while because I can just go somewhere else that accepts my card.”

Ben Abouakr tried to fill up at a Petro-Canada station in Toronto, but couldn’t, so he went to a nearby Shell instead.

“I saw the piece of paper on the pumps that said cash only,” he told CBC News. “It must be something – for three days? It’s more than a technical problem.”

Could be a ‘big problem’

Suncor has yet to link the cybersecurity incident to problems at Petro-Canada, or even say what kind of incident it was, but Ian Paterson, the CEO of cybersecurity firm Plurilock, says the incident shows some of the telltale signs of a “ransomware” attack. attack, in which nefarious actors gain access to a company’s network and then hold it hostage in exchange for payment.

However, he warns that it may not be.

“If a company voluntarily shuts down systems to try and find out what happened, it’s very similar to a ransomware attack,” says Paterson.

Those attacks often happen when the hackers believe there is some kind of vulnerability, so they often happen during downtimes like during holidays or on the way to a weekend.

“It’s not surprising to see something happen on a Thursday or Friday,” he said.

Whatever the cause, given that the outage has been going on for so long, he thinks the company has a “massive problem”.

“If there’s such a widespread attack, it’s going to be time consuming and expensive,” he said.

Reputational damage

Jon Ferguson, general manager of cybersecurity at the Canadian Internet Registration Authority, agrees that the impact of this cybersecurity incident is likely to last a long time for the company

One of the challenges is that it is a large organization, he said.

“If they have to modify critical systems, it could take a very long time to recover, depending on what was damaged,” Ferguson told The Canadian Press.

“And then there’s the cost of disruption. I have no idea how much gas Petro-Canada didn’t sell because people didn’t have cash.”

There’s also the cost of the damage to the company’s reputation, he said, “which is very hard to measure, but you’ll probably think twice before you put your credit card in a Petro-Canada gas machine right now.”

Companies affected by cybersecurity incidents

The incident is just the latest cybersecurity breach to make headlines in recent times. In February, retailer Indigo was hit by a ransomware attack that wiped out credit and debit payments for days and the online store for nearly a month.

And in 2021, the American pipeline company Colonial Pipeline was taken offline after hackers infiltrated the company’s systems. That attack blocked the flow of gasoline over the main pipeline that supplies the East Coast, leading to widespread shortages.

Last week, the Canadian Center for Cyber ​​Security warned that ransomware attacks — in which hackers gain access to a company’s internal system and demand payment in exchange for a refund — were the biggest cyber threat to Canada’s oil and gas sector.

Ransomware is almost certainly the number one cyberthreat to the reliable supply of oil and gas to Canadians.

Last year, Suncor was one of two dozen oil and gas companies to sign the Cyber ​​Resilience Pledge, a vow to strengthen cybersecurity, following the Colonial Pipeline hack the previous year.