Oldelval Cyberattack Hits Argentina’s Top Oil Pipeline

An Oldelval cyberattack has exposed the digital fragility of Argentina’s most strategic oil artery, even as the crude that feeds the country’s refineries and export terminals kept flowing without a pause.

What Oldelval disclosed

Oleoductos del Valle, known as Oldelval, told the National Securities Commission (CNV) in a material-event filing that it had suffered a cyberattack affecting its administrative systems. The disclosure, made late last week, is required of firms with listed debt.

The company said it activated its cybersecurity protocol and fully restored the affected platforms, allowing administrative work to resume normally. Executives described the episode as ‘100% controlled’.

Crucially, Oldelval stressed that the intrusion never reached the systems that move crude. Oil transport, it said, continued without interruption throughout the incident.

The firm did not detail the type of threat or the entry point the attackers used, and said it was still assessing the full scope while filing reports with the competent authorities. It has not reported paying any ransom.

The oil kept moving

The reassurance matters because of what Oldelval carries. About 75% of the crude produced in the Vaca Muerta shale basin travels through its ducts, feeding domestic refineries and a fast-growing export trade.

Because the breach hit back-office systems rather than the industrial controls that govern pumping stations and valves, the physical flow of oil was never at risk, according to the company. That distinction, between corporate IT and operational technology, is central to how such incidents play out.

In many industrial hacks, attackers reach billing, email and document systems long before, if ever, they touch the specialised controllers that run physical equipment. Keeping those two worlds separated is the first line of defence for any pipeline operator.

Even so, the proximity of the attack to critical infrastructure unsettled the sector. An operator that handles the bulk of the basin’s output is exactly the kind of target that ransomware crews increasingly probe.

Who is behind the attack

Oldelval pointed to both local and foreign hackers as possible culprits, with a foreign-origin operation emerging as the strongest hypothesis. A group calling itself ‘The Gentlemen’, which markets itself as a ransomware-as-a-service outfit, claimed the hit on social media.

The same group had struck days earlier at Ecopetrol, Colombia’s largest oil company, which detected the intrusion and blocked mass encryption of its files but could not prevent the download of data from about 3,300 user accounts and cloud information tied to 15 group companies.

Ransomware-as-a-service lets affiliates rent malicious tools in exchange for a share of any ransom, lowering the barrier to large-scale extortion. The model has turned energy and logistics firms across the Americas into recurring targets.

Attribution is rarely quick or certain. Groups often exaggerate their reach, and investigators can take weeks to confirm how an intrusion began, leaving companies to weigh public claims against their own forensic findings.

A pipeline at the heart of Vaca Muerta

Oldelval runs more than 1,700 kilometres of pipeline connecting the fields of the Neuquén basin with storage and export terminals at Puerto Rosales, near Bahía Blanca, and Punta Colorada. By some estimates, close to 90% of the basin’s oil moves through its system.

Its shareholder register mirrors that importance. State-controlled YPF is the largest owner with 37%, followed by ExxonMobil, Chevron, Pan American Energy, Pluspetrol, Tecpetrol and Pampa Energía.

Its client list spans nearly every major producer in the play, including YPF, Vista Energy, Chevron, Shell, Tecpetrol, Pluspetrol, Pampa Energía and TotalEnergies. A serious disruption at Oldelval would ripple across the entire sector.

That concentration is both the point of the system and its vulnerability. The efficiency of funnelling the basin’s crude through one operator is exactly what makes any threat to that operator a national concern.

Expansion collides with new digital risk

The attack lands as Oldelval races to expand. Its Duplicar Norte project, a 207-kilometre line linking pumping stations at Puesto Hernández in Neuquén and Allen in Río Negro, carries an estimated US$380 million price tag and was awarded to Paolo Rocca’s Techint.

Techint had already built the second module of Duplicar Plus, a 254-kilometre stretch it delivered in December 2024 ahead of its contractual deadline, underscoring how quickly the basin’s export spine is being enlarged.

Early operation of Duplicar Norte is slated for late 2026, with full commissioning targeted for the first quarter of 2027 under a ship-or-pay scheme, in which shippers pay for capacity whether or not they use it, backed by Pluspetrol, Chevron, Tecpetrol and Gas y Petróleo del Neuquén.

Once integrated with the Duplicar Plus and Vaca Muerta Sur systems, and operating under Argentina’s large-investment incentive regime, the network is designed to channel close to 80% of the region’s oil toward the coast, supporting crude exports the company estimates at US$6 billion to US$8 billion a year.

A regional wave of infrastructure attacks

Oldelval is not an isolated case. The same group had just hit Ecopetrol, and the weekend of the Argentine disclosure also brought reports of a cyberattack affecting part of the technology infrastructure of the Panama Metro.

The pattern points to a broader targeting of Latin American energy, transport and logistics operators, whose growing reliance on connected systems has widened the surface criminals can exploit.

The template is familiar from abroad. In 2021, a ransomware attack on the United States’ Colonial Pipeline briefly disrupted fuel supply along the East Coast; the company paid a ransom of 75 bitcoin, then worth about US$4.3 million, part of which the FBI later recovered.

For operators, the lesson is that back-office breaches can become operational crises if defences are thin. Segmentation, monitoring and rehearsed response plans increasingly separate a contained scare from a costly shutdown.

What comes next for Oldelval

For now, Oldelval says the damage was contained and the oil never stopped. It has restored its systems, reported the incident to regulators and continues to assess the full scope.

The open question is whether the sector treats the scare as a warning and hardens its defences before the next attempt lands closer to the controls that actually move crude.

Regulators may also take an interest. A material-event filing puts the incident on the public record, and investors in Oldelval’s listed debt will watch for any sign that the breach was deeper than disclosed.

Above all, the episode is a reminder that Argentina’s energy ambitions now rest on digital foundations as much as physical ones. Scaling Vaca Muerta safely means defending the software that runs it, not just the steel.

Why the stakes keep rising

The timing sharpens the concern. Vaca Muerta has become the engine of Argentina’s energy future, and the infrastructure carrying its crude is being enlarged and automated at speed.

Oldelval’s own projections capture the scale: once its expansion is complete, the system is meant to underpin crude exports worth US$6 billion to US$8 billion a year, a figure Argentina’s external accounts increasingly rely on.

A prolonged disruption to that flow, whether physical or digital, would reach beyond the company. It would touch export revenue, refinery supply and the confidence of the producers and lenders backing the basin’s growth.

That is why a back-office breach at Oldelval drew national attention despite causing no operational damage. The margin between an administrative scare and a supply shock is thinner than it looks.

For the producers that own and use the pipeline, from YPF to the majors, cyber-resilience is becoming as strategic as steel capacity or export permits.

The episode, contained as it was, is likely to accelerate spending on digital defences across a sector that has poured billions into pipes and terminals.

A test for the whole sector

The breach also lands as a test of transparency. By filing a material-event notice, Oldelval chose disclosure over silence, setting a benchmark other operators may be pressed to follow.

Argentine regulators offer limited public guidance on reporting cyber incidents at critical infrastructure, and this case may sharpen expectations for how quickly and fully firms come forward.

Producers, insurers and lenders will all be watching. Cyber risk is increasingly priced into financing and coverage for large energy assets, and a visible incident can move those terms.

For a basin racing to expand exports, the reputational stakes are as real as the operational ones: buyers want assurance that Argentine crude will keep flowing on schedule.

This is reporting, not investment advice. Confirm current figures with official sources before acting.

Frequently Asked Questions

Related reading

• Argentina’s Main Oil Pipeline Was Hacked. The Oil Kept Moving.
• Browse Latin America Company Intelligence
• Brazil’s Financial Morning Call for Monday, August 3, 2026

This article was produced by The Rio Times’ automated newsroom system. How we use AI · Report an error

The Rio Times · Power Map

See who really holds power in Latin America

Click to open the Power Map →