Pipeline Attacks highlight Third Party Threat to Critical Infrastructure

Multiple U.S. pipeline companies experienced disruptions to third-party EDI data systems supplied by a vendor unit of Energy Services Group, interrupting document and transaction flows but not reportedly impacting SCADA or pipeline operations. Security experts characterize the incidents as likely financially motivated (possible ransom or transactional-data theft), emphasize the risk of third-party access as an attack vector, and recommend stronger third-party security controls such as audits, contracts requiring security practices, multifactor authentication, restricted remote access, and vendor vetting.