The business IT infrastructure of CONPET S.A. was hit by a cyberattack. The incident took place on 3 February 2026. This company is the operator of the National Oil Transportation System. Its official website became temporarily completely inaccessible to visitors. Nevertheless, the national transport of crude oil and gasoline continued normally. The official statement of 4 February immediately explained the reason for this success. The SCADA industrial control systems were not affected at all. Separating the office network from the industrial one was essential. This smart separation turned the incident into a mere short news item. Avoiding a major energy crisis was a real success. Let's see how this protective barrier works in practice. Every entrepreneur with production facilities must understand this concept.
What happened during the attack on CONPET?
The company officially announced the attack on its business network. The equipment that physically controls the oil pumps remained intact. The internal telecommunications network operated without interruption. CONPET immediately notified the prosecutors of DIICOT (the Romanian prosecutors for organised crime and terrorism) for an investigation. They also cooperated closely with the cybersecurity authorities. The deep technical details of the initial attack were not disclosed. We will not speculate at all about this technical information. What really matters enormously is the decision that was not taken. The operators were never forced to shut down the pumps. Had the computers shared the same network, a shutdown would have been inevitable. It would have been a disaster similar to other famous recent cases.
Why is network separation a vital decision?
The office computer network (IT) is always the most exposed part. Here we find mailboxes, accounting applications and web browsers. It is the place through which almost every modern cyber attacker gets in. On the other hand, the industrial network (OT) produces a physical impact. If the industrial zone is compromised, the pumps slip out of control. An infected factory does not lose just its website, it stops its machinery. A technical auditor will ask one extremely simple question. If the attacker completely controls the office computers, what happens to production? The correct and healthy answer must always be "absolutely nothing". The attacker must not be able to move from one network to another unnoticed.
| Technical security measure | Protective effect in practice |
|---|---|
| Completely distinct zones (Firewall) | The business network is physically separated from the machinery on the shop floor. The virus is stopped at the gate. |
| Separate access accounts | The accountant's password gives no right at all to modify industrial commands. |
| Supplier control (MFA) | External suppliers connect to the machinery only using two-factor authentication. |
Where does the chain break in smaller factories?
We often carry out technical assessments in many small industrial companies. We visit factories, water treatment plants and various local operators. Unfortunately, we very frequently encounter exactly the opposite of the success story. We find a single flat computer network with no barriers. The machinery server sits in the very same network as the employees' laptops. Any virus received by email goes straight to the control line. Automation suppliers frequently connect remotely directly to the equipment. They use a single simple password shared by their whole team. There is no login history and no complex, secure authentication. On top of that, backups of the machinery are completely missing.
What would have changed the outcome of this incident for the worse?
At CONPET, the outcome of the attack was extremely good. But how could it still have turned into a real technical disaster? A single office account with access to production would have been fatal. One forgotten open firewall rule would have brought immediate chaos. A supplier's direct access would have offered hackers an uncontrolled entry point. Any small breach turns the cyberattack into a halt in transport. This is exactly why the European NIS2 directive appeared. This legislation requires defence measures proportionate to the great risk. Network segmentation is in fact the first fully mandatory measure today. Every modern company with physical processes urgently needs it.
What can you do this very week for your factory?
Stop for a moment and draw your company's zones on paper. Check immediately with the IT team whether you have a working firewall between them. If the network is completely open, your factory is living on hope alone. List absolutely all external access paths of all partners. Make sure that absolutely everyone uses only two-factor authentication. Find the employees who have full access in both of the company's networks. Start today by separating their accounts and technical privileges. Urgently ask your partners for backups of the production machines. Carry out an IT audit for companies in order to prevent disaster. Specialists can configure the newest cybersecurity solutions available today. Ask for support on the contact page and let's secure the technology lines.