Cyber Incident Victim: Mabanaft GmbH
Date:
Jan 2022
Location:
Germany
Summary
A cyberattack targeted subsidiaries of the Marquard & Bahls group, including Mabanaft GmbH and Oiltanking, disrupting automated fuel loading systems and forcing operations to shift to alternative charging points. The incident raised concerns over potential fuel shortages affecting major clients like Shell, though officials assured no immediate supply risk. Operational paralysis stemmed from the inability to manually override compromised computerized processes, threatening prolonged supply chain impacts if unresolved. While unclaimed, the attack's scale aligned with prior warnings about state-sponsored threats targeting German infrastructure.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
A cyberattack targeting Oiltanking GmbH, a major German petrol distributor and subsidiary of the Marquard & Bahls group, severely disrupted operations on or around January 29, 2022. The incident also impacted Mabanaft GmbH, an affiliated oil supplier under the same parent company, suggesting a potential breach point at the corporate group level. The attack paralyzed Oiltanking’s automated tank loading and unloading systems, which relied entirely on computerized processes with no manual fallback option. This forced the company to halt operations at its 13 German tank farms, leaving them unable to serve fuel trucks. Oiltanking supplies 26 companies across Germany, including Shell’s network of 1,955 gas stations, raising immediate concerns about nationwide fuel shortages. German media reported fears of cascading effects on transportation and heating fuel availability, though officials later sought to downplay imminent supply risks.
In response, Oiltanking implemented contingency measures by redirecting operations to alternative charging points while working to restore its primary systems. The company issued a public statement acknowledging the attack’s operational impact but did not disclose technical details about the intrusion vector or affected infrastructure. Frank Shaper, managing director of Germany’s tank storage association, confirmed the incident posed no immediate threat to national fuel supplies but warned prolonged IT disruptions could strain supply chains. The German domestic intelligence service (BfV) had issued an alert one week prior about cyberattacks by the Chinese state-linked APT27 group, though no attribution was confirmed for this incident. Analysts noted the attack’s potential to cause large-scale economic disruption given Oiltanking’s critical role in fuel logistics, particularly through its Shell supply contract. Recovery efforts remained ongoing as of February 1, 2022, with no public timeline for full restoration of automated systems.