Bahrain Petroleum Company

Bapco, also known as the Bahrain Petroleum Company, is the national oil company of the Kingdom of Bahrain, with its headquarters located in Bahrain. It is responsible for the full spectrum of hydrocarbon activities, including exploration, production, refining, and marketing of oil and gas products. The company operates Bahrain’s only refinery, which processes crude oil into gasoline, diesel, jet fuel, and other petroleum derivatives for both domestic consumption and export. In addition to refining, Bapco engages in petrochemical manufacturing and supplies lubricants and specialty chemicals to various industries. Its operations span the upstream, midstream, and downstream sectors, making it a vertically integrated energy enterprise.

As a state‑owned enterprise, Bapco is wholly owned by the Government of Bahrain and reports to the Ministry of Oil and Environment, which oversees its strategic direction and regulatory compliance. The company’s role as the sole national oil company grants it a unique position in Bahrain’s energy landscape, ensuring the country’s energy security and contributing significantly to national revenues. In December 2019, Bapco was targeted by a state‑sponsored Iranian cyberattack that deployed the Dustman data‑wiping malware, exploiting a VPN vulnerability to gain access and disrupt systems. Although the attack caused limited data loss and system crashes, it was detected the following day, allowing containment and preventing more extensive damage.

The incident underscored the growing cyber threat faced by critical infrastructure in the energy sector and highlighted Bapco’s need for robust defensive measures against sophisticated adversaries. Following the event, the company undertook a review of its network security, particularly around remote access points and domain controller protections, to mitigate similar risks. These actions reflect Bapco’s ongoing effort to balance its core hydrocarbon business with the imperative of protecting its digital assets.