Glossary term
Ransomware
Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.
Read more
Significant cyber incident
Pemex ransomware attack, Mexico, 2019
Pemex, Mexico's state oil company, detected a ransomware attack on 10 November 2019 that began at a computer center in the State of Mexico.
In short
Pemex, Mexico's state oil company, detected a ransomware attack on 10 November 2019 that began at a computer center in the State of Mexico. Pemex said at least 5 percent of personal computers were affected and production continued, but employees told reporters that payments, billing, email and phones were disrupted for weeks. Reuters reported a ransom note demanding 565 bitcoins, and the energy minister said Pemex would not pay.
What happened
On Sunday 10 November 2019 a Pemex notice reported an incident at the SITE computer center of its offices in the State of Mexico. It said a ransomware had been detected and that a fix was expected in 48 hours. On Monday 11 November Pemex said attempted attacks had been neutralized and had affected at least 5 percent of personal computers. It said production, supply and fuel stocks were guaranteed.
Reuters, Bloomberg and Expansion reported a different picture inside the company. Staff were told to disconnect from the network and not to turn on computers. Payments and billing systems were hit, fuel invoices were done by hand, and staff used WhatsApp because email did not work. A ransom note seen by Reuters pointed to a darknet site linked to DoppelPaymer and asked for 565 bitcoins. Reuters also reported that an internal email named Ryuk, and that there was confusion over which ransomware it was.
On 13 November the energy minister said Pemex would not pay. Two weeks later some systems were still affected, according to Infobae. In its annual reports to the US SEC, Pemex said the attack did not affect the continuity of its business and that it had made complaints to the competent authority.
Timeline
-
10 November 2019
Pemex detects a ransomware attack. A notice about an incident at the SITE computer center in the State of Mexico is shared on Twitter. It says a fix is expected in 48 hours.
-
10 November 2019
The PMI trading arm system shuts at midday, according to Bloomberg. An unnamed source tells Expansion the Lazaro Cardenas refinery did not run normally.
-
11 November 2019
Pemex says attempted attacks were neutralized and affected at least 5 percent of personal computers. Sener says fuel supply is guaranteed and reports of shortages are false.
-
11 November 2019
Reuters reports that servers crashed and administrative work stopped. Staff are told to disconnect from the network.
-
12 November 2019
Bloomberg reports manual billing, with a risk to payment of staff and suppliers. Pemex posts on Twitter that storage terminals operate normally.
-
12 November 2019
An internal Pemex email seen by Reuters names Ryuk. Bloomberg's source also names Ryuk.
-
13 November 2019
Reuters reports a ransom note linked to DoppelPaymer asking 565 bitcoins. Energy Minister Rocio Nahle says Pemex will not pay.
-
26 November 2019
Infobae reports some systems still affected after two weeks. Neither Pemex nor the authorities had identified the malware type.
-
2020
Pemex's 2019 annual report to the SEC says it detected the attack on 10 November 2019, that continuity was not affected, and that an investigation had started.
-
2021
Pemex's 2020 annual report to the SEC adds that it made complaints to the competent authority.
How the attack worked
No government source opened for this page describes how the attackers got in. Pemex’s own filings say only that ransomware targeted certain software applications. This page therefore records what was reported about the effects and the ransomware, not the entry route.
The ransomware
Pemex’s first notice said the ransomware can lock the screen or encrypt important files with a password. Data encryption of this kind is Data Encrypted for Impact (T1486). The ransom note seen by Reuters pointed to a darknet site linked to DoppelPaymer and asked for 565 bitcoins with a 48-hour deadline. An internal email named Ryuk. Reuters wrote that there was some confusion about which one was used. Infobae reported on 26 November 2019 that neither Pemex nor the authorities had identified the malware type.
The response inside Pemex
Staff were told to disconnect from the network and back up key data. Users were told not to turn on computers. Reuters’ source said Pemex was reconnecting unaffected computers using patches and wiping infected ones. Employees said the patches slowed their computers.
Why the office systems mattered
Payments, billing, email and phones were hit. Fuel invoices from storage terminals were done by hand. Pemex said field operations, plants and wells kept working, and the energy minister said the attack hit the Mexico City administrative headquarters.
Background on DoppelPaymer
The FBI, on 10 December 2020, described DoppelPaymer actors as stealing data before encryption and using phone calls to pressure victims. That notice does not mention Pemex, so it is context only.
- DetectionPemex detected ransomware at the SITE computer center on 10 November 2019
- SpreadServers crashed and staff were told to disconnect from the network and not to turn on computers
- EncryptionThe ransomware can lock screens or encrypt files with a passwordTechnique T1486 (MITRE ATT&CK, opens in a new tab)
- Ransom demandA note seen by Reuters asked for 565 bitcoins with a 48-hour deadline
- DisruptionPayments, billing, email and phones were hit and invoices were done by hand
- RecoveryUnaffected computers were reconnected with patches and infected ones wiped
ATT&CK techniques
Who says who was behind it
No public attribution by a government. No named group was identified by Pemex or Mexican authorities in the sources opened.
Reported by Reuters, 13 November 2019: a ransom note on Pemex computers pointed to a darknet website affiliated with DoppelPaymer.
Reported by Reuters, 12 November 2019: an internal Pemex email said the company was targeted by Ryuk. Bloomberg, via Infobae on 12 November 2019, also quoted a person naming Ryuk.
Sources differ on the malware. Reuters wrote on 13 November 2019 that there was confusion about which ransomware was used. Infobae reported on 26 November 2019 that neither Pemex nor Mexican authorities had identified the type.
The FBI notice of 10 December 2020 on DoppelPaymer does not name Pemex.
Impact
Pemex said the attack affected at least 5 percent of personal computers (in Reuters wording, less than 5 percent of computers; sources differ in wording). It said production, supply and fuel inventories were guaranteed and, in its SEC annual report, that business continuity was not affected.
Reuters, Bloomberg and Infobae reported disruption of payments, billing, email, phones and file access, according to employees and internal emails. Fuel invoices from storage terminals to petrol stations were done by hand on 12 November 2019.
A source told Reuters that exploration and production staff were not affected. Another told Expansion that the Lazaro Cardenas refinery may have been affected.
Some systems were still affected two weeks later, according to Infobae on 26 November 2019. Pemex said payroll would be paid as scheduled.
Ransom demand: 565 bitcoins, nearly 5 million US dollars at the time, according to Reuters. No source opened says a ransom was paid. No source opened gives a cost figure for recovery.
Government and regulator response
- 10 November 2019: Pemex shared a notice that ransomware had been detected at the SITE computer center and said a fix was expected in 48 hours.
- 10 to 12 November 2019: staff were told to disconnect from the network, not to turn on computers, and to back up key data (Reuters). Pemex was reconnecting unaffected computers and wiping infected ones (Reuters source).
- 11 November 2019: Pemex said the attempted attacks were neutralized, production and supply were guaranteed, and the public should avoid rumors. Sener said fuel supply was guaranteed.
- 13 November 2019: Energy Minister Rocio Nahle said Pemex would not pay the ransom (Reuters).
- 2020: Pemex told the SEC it applied remedial measures to contain the attack and started an investigation.
- 2021: Pemex told the SEC it had made complaints to the competent authority. The sources opened give no result of any investigation.
Lessons
-
Office systems carry the money
The attack hit payments, billing and email, and fuel invoices were done by hand, while wells and plants kept working. Plan for finance and logistics failing first.
-
Public statements and staff reports can differ
Pemex said less than or about 5 percent of computers were affected, while employees described weeks of disruption. State what is confirmed and update it.
-
Have a plan for communications
Staff used WhatsApp because email was down. Agree a backup channel before an incident.
-
Know the strain, or say you do not
Reports named both Ryuk and DoppelPaymer, and Infobae said the type was not identified. Early guesses can be wrong, so label them.
-
Say early that you will not pay, if that is the decision
The energy minister said within days that Pemex would not pay. Decide who makes that call before an attack.
-
Clean up takes weeks
Two weeks on, files and email were still hard to reach and patches slowed computers. Budget time for rebuild.
What to check in your own organization
-
Finance without systems
If payments and invoicing stopped today, could you pay staff and suppliers by hand for two weeks?
-
Backup channel
Do you have a way to talk to all staff that does not depend on company email?
-
Disconnect plan
Can your team cut computers from the network quickly, and does staff know not to switch machines on?
-
Backups
Are backups kept offline or disconnected from the network, as the FBI advises for DoppelPaymer?
-
Data theft
Would you spot large data leaving your network before encryption starts?
-
Office and plant split
Are office networks separated from operations so a ransomware outbreak stays on the office side?
-
Statements
Is there a pre-agreed owner and wording for public statements, so numbers match what staff see?
Where it happened
- Industry Energy and utilities Exposed network devices, destructive attacks, ransomware and state-backed groups that target energy and utility operators, and the rules that apply.
- Country Mexico Mexico faces attacks on banks and payment systems, attacks on state bodies and companies, and banking fraud. Latin America
Questions
What happened to Pemex in November 2019?
Pemex detected a ransomware attack on 10 November 2019. It said at least 5 percent of personal computers were affected and production was not stopped. Staff reported weeks of disruption to payments and email.
Who was behind it?
There is no public attribution by a government. Reuters reported a ransom note linked to DoppelPaymer and an internal email naming Ryuk, so sources differ.
Did Pemex pay the ransom?
Energy Minister Rocio Nahle said on 13 November 2019 that Pemex would not pay. No source opened says a payment was made.
How much was demanded?
Reuters reported 565 bitcoins, nearly 5 million US dollars at the time, with a 48-hour deadline.
Did fuel supply stop?
Pemex and Sener said supply was guaranteed. Bloomberg reported fuel invoices were done by hand. Unnamed sources said a refinery may have been affected, so sources differ on the detail.
Is this linked to a 2022 attack?
The sources opened for this page do not link any later event to the November 2019 attack.
Sources
- Pemex Form 20-F for fiscal year 2019 (SEC filing) U.S. Securities and Exchange Commission
- Pemex Form 20-F for fiscal year 2020 (SEC filing) U.S. Securities and Exchange Commission
- Pemex sufre un ciberataque, pero Sener niega que cause desabasto de gasolina (11 November 2019) Expansion
- Mexico's State Oil Firm Hampered by Ransomware Attack (12 November 2019) Reuters via Carrier Management
- Pemex ransomware attack: Hackers demand millions in bitcoin (13 November 2019) Reuters via El Universal
- Pemex Faces Payment Problems After Cyberattack Shut Down System (12 November 2019) Bloomberg News via Transport Topics
- Pemex reconocio ataque cibernetico y pidio a sus empleados no acceder a su sistema (12 November 2019) Bloomberg via Infobae
- Comunicacion de Pemex sigue afectada tras devastador ciberataque (26 November 2019) Infobae
- DoppelPaymer Ransomware Attacks on Critical Infrastructure Impact Critical Services, PIN 20201210-001 (10 December 2020) FBI (coordinated with CISA)
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.