Natural gas compression facility ransomware

CISA Alert AA20-049A described a February 2020 ransomware infection at a US natural-gas compression facility where a phishing email-borne payload moved laterally from the IT network into the OT environment, encrypting Windows-based HMIs and historian servers. The facility entered a controlled shutdown for approximately two days.

Pipeline operation was interrupted for roughly two days at the affected compression facility while the operator failed over to redundant assets and rebuilt the encrypted systems. CISA assessed the impact as localised, with no direct gas-supply disruption to customers.