Petro-Points member info breached in Suncor hack

Canada’s Suncor Energy has revealed some Petro-Canada loyalty rewards member information was compromised during last month’s breach, which incapacitated online services at the gas station chain for days.

“Based on our investigation to date, we determined that our IT network was accessed by an unauthorized party on or about June 21st, 2023,” Suncor said in a press release dated July 6th.

“We have determined that our Petro-Points program has been impacted. The unauthorized party obtained members’ basic contact information,” the release stated.

The global energy company said they are in the process of notifying Petro-Points members, as well as the appropriate privacy regulators.

Petro-Canada also reached out to its customers to acknowledge regret over the data leak and provide contact information for its points program members.

“The security of your personal information is important to us. We regret this incident has happened, and we appreciate your patience and understanding as we work to resolve the situation," it tweeted.

Suncor, first announced they had “experienced a cybersecurity incident’ in a separate release on June 25th.

Petro-Canada, a chain of retail gas stations, truck stops, and a subsidiary of Suncor, experienced temporary disruptions that the company said have largely been resolved.

There are over 1,500 Petro-Canada service stations located across the North American nation.

On June 26th, Petro-Canada reported its website and Petro-Points mobile app were offline. Car wash services and payment systems were also reported down by customers, forcing some gas stations to only accept cash payments.

Initially, Suncor had said it was not aware any customer, supplier, or employee data had been compromised or misused as a result of the breach.

Suncor said after becoming aware of the unauthorized access, the company "immediately activated a business continuity plan, engaged leading IT and cybersecurity experts, and notified relevant authorities."

The incident has not impacted the safety and reliability of field operations, said Suncor, the largest producer of synthetic crude oil in Canada and one of the largest independent energy companies in the world.

The Calgary, Alberta-based firm also said it will notify affected parties if any additional information is found to be compromised.