Petróleos de Venezuela SA

Summary

A cyberattack on Petróleos de Venezuela SA disabled its operational platforms, including SCADA and SAP, forcing the company to rely on manual processes and messaging apps for communication. The disruption slowed payments to contractors and employees, hindered access to production data, and left retirees unable to verify pension deposits.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On December 15, 2025, a cyberattack shut down the computer systems of Petróleos de Venezuela SA, forcing the state‑owned oil company to conduct its day‑to‑day operations through phone calls and handwritten reports. The disruption slowed payments to contractors and employees and hindered the flow of production data, according to individuals with knowledge of the situation who spoke on condition of anonymity. The attack occurred amid a broader context of deteriorating technological infrastructure at PDVSA, stemming from decades of underinvestment, corruption, and U.S. sanctions that have limited the company’s ability to modernize its systems. Although the perpetrators have not been identified, the United States, which has sought to control future Venezuelan oil sales after the capture of Nicolás Maduro, has denied responsibility for the incident.

The assault also compromised PDVSA’s SCADA platform, which oversees processes in refineries, compression plants and pipelines, and left the company’s SAP software inaccessible, requiring many operational tasks to be performed manually. Internal email services were taken offline, restricting official communication across the organization. Employees in legal, finance, engineering and health departments located in Caracas, Barinas, Puerto La Cruz and El Tigre began using WhatsApp or Telegram to exchange information, while staff working in the Orinoco Belt relied on Telegram and Gmail for their day‑to‑day coordination. These ad‑hoc channels became the primary means of sharing updates and instructions as the company’s standard digital tools remained unavailable.

As a result of the system outages, PDVSA could not access the platforms that handle accounting, payments and production data, leaving many workers uncertain about their compensation. A retiree reported being unable to verify his January pension deposit through the company’s portal and was instructed to submit his personal information by hand to a clerk at PDVSA headquarters in Caracas, who then processed the payment via an alternative account. The reliance on manual workarounds and informal messaging apps has persisted for at least a month following the attack, reflecting the ongoing impact on the oil giant’s operational and administrative functions.

Sources

Sources available to members: 1 source.