Ongoing Fires in Iran's Petrochemical Industry; 'Computer Systems May Have Been Hacked'

On Thursday, October 1st, the Associated Press reported on the series of fires in Iran's petrochemical facilities, suggesting that the continuation of these incidents raises suspicions of hacking of petrochemical systems and software sabotage in Iran. The report referenced statements from Iranian officials regarding the presence of 'some contamination (by a virus)' and added that hacking may have played a role in these incidents. The Associated Press noted that Iranian officials have insisted that six fires in petrochemical facilities and some equipment over the past three months are unrelated to cyberattacks, but the government's acknowledgment of viral contamination raises the possibility of coordinated efforts to target Iran's petrochemical equipment, similar to how the 'Stuxnet' virus disabled thousands of Iran's uranium enrichment centrifuges years ago. Among the recent incidents, the worst fire occurred at the Bou Ali Sina petrochemical facility, with Iranian insurance officials estimating the damage from this incident at $67 million. Iranian officials attributed the cause of this incident to a paraxylene leak, which is a flammable substance. The report adds that other fire incidents include: - A fire at the storage tank of the Bistoon petrochemical facility on July 29 (August 8), attributed by Iranian officials to a power network failure. - An explosion of the gas pipeline in Ganaveh on August 6 (August 16), which resulted in one death and three injuries. - A fire on August 7 (August 17) at the Imam Port petrochemical storage site, which took two days to extinguish. - A fire in the wastewater pond of phases 15 and 16 of South Pars on August 30 (September 9). - Finally, a fire at the Mobin petrochemical facility on September 14 (September 24), which injured four people. The report references initial statements from Brigadier General Gholamreza Jalali, head of the Passive Defense Organization, who denied any connection between these incidents and cyber sabotage, noting that Iran's aging equipment and pipelines have deteriorated due to years of sanctions, while also observing a rapid increase in Iranian production post-sanctions. At the same time, 'Iran faces occasional attacks from separatist groups.' However, Jalali warned on August 27 (September 6) that petrochemical industries have been targeted, attributing the cause to imported equipment and its installation in these industries. According to the IRNA news agency, he stated that 'viruses had contaminated the petrochemical complexes and unusual commands from viral software can be dangerous.' Nevertheless, he emphasized that cyberattacks were not the cause of the fires. Jalali further stated that passive defense measures are underway, but did not provide details. The report adds that it remains unclear whether Iran, which has recently expanded its software to counter cyberattacks, has the capability to fend off threats, but the Russian company Kaspersky, one of the largest developers of content security management systems that had previously investigated the Stuxnet virus, told the Associated Press that it has not entered the investigation process regarding Iran's petrochemical facilities. The Associated Press further noted Jalali's comments about viral contamination from imported parts, raising suspicions that a foreign power may be behind this issue. Robin Mills, an industrial expert and head of Qamar Energy in Dubai, told the news agency that during sanctions, Iran typically sourced necessary parts from the black market. 'They likely did not always succeed in purchasing high-quality parts and had to buy second-hand, low-quality, or non-standard equipment.' Eidan Oudi Edri, a former Israeli military official who is now the CEO of the cybersecurity company Nation A, stated that such attacks require 'significant resources' and cannot be the work of individual hackers. He expressed complete confidence, based on his company's experience and oversight, that the fires were not a result of cyberattacks, although no organization, government, or company ever takes responsibility for such attacks. However, Ralph Langer, another industrial expert who studied the Stuxnet virus, told the Associated Press that although his company has not investigated this issue, he doubts that the fires were a result of cyberattacks. The Associated Press writes that there is considerable suspicion that the U.S. and Israel were behind Stuxnet. 'This virus, although the most famous cyberattack against Iran, was not the only attack on the country's industries.'