Cyberattack

Fuel Retail Station

Orpak fuel-management systems — CyberAv3ngers compromise claim

Claimed 14 October 2023; activity observed into January 2024

Israel and United States (campaign; country-level marker in Israel)

31.8000, 34.8500

Loading free detailed map…

What happened

CyberAv3ngers claimed it compromised Orpak SiteOmat fuel-management systems used by filling stations in Israel and the United States, publishing screenshots and stolen data and asserting that 200 stations were affected. Claroty later analyzed IOCONTROL malware recovered from a closely related Gasboy payment terminal and identified command-and-control infrastructure associated with the campaign. The available evidence supports a real effort against fuel-retail operational technology, but public reporting did not verify that all 200 claimed stations were compromised or establish nationwide fuel shortages, panic buying or a prolonged dispatch-system outage. The record therefore remains reported rather than documented at the claimed scale.

When cited sources give different casualty, damage or spill figures for this event, they’re reported side by side above rather than merged into one number. See how confidence levels work.

Evidence
Reported / attributed
Confidence
Moderate
Infrastructure
Fuel Retail Station
Current temperature
Loading…
Latitude
31.8000°
Longitude
34.8500°

Attribution

Claimed by CyberAv3ngers, an Iran-linked cyber group

The group publicly claimed the Orpak attacks. Later technical research recovered IOCONTROL malware from a related Gasboy payment terminal and linked infrastructure to the campaign, but did not independently confirm every claimed victim or the claimed count of 200 stations.

Sources

  1. Inside a New OT/IoT Cyberweapon: IOCONTROLClaroty Team82 · Incident reporting