Suncor Energy cyberattack disrupted payments at Petro-Canada stations

Suncor Energy, the Calgary-based oil and gas company that owns the Petro-Canada retail chain, disclosed a cybersecurity incident on June 25, 2023, the same weekend that card payments began failing at Petro-Canada sites. Suncor later placed the intrusion on or around June 21.

Card payments failed at pumps and tills across the chain's more than 1,500 Canadian locations, leaving many sites able to take only cash. Customers also could not sign in to the Petro-Canada app or website, earn or redeem Petro-Points loyalty rewards, or use car wash season passes.

Suncor said it had notified the appropriate authorities, engaged a third-party investigator and was working to resolve the incident, while warning that transactions with customers and suppliers would continue to be affected in the meantime. The company did not say what kind of attack it was and did not confirm whether ransomware was involved.

On the question of data, Suncor's statement was narrow: it said it was not aware of any evidence that customer, supplier or employee data had been compromised or misused as a result of the situation. Neither the point of entry nor the identity of the attacker was disclosed, and no group claimed the intrusion in the days after the disclosure. On July 6, 2023, Suncor confirmed that an unauthorized party had accessed basic information belonging to Petro-Points members and said it was notifying those customers along with privacy regulators.