Argentina’s Main Oil Pipeline Was Hacked. The Oil Kept Moving.

Rio Times · Argentina

Argentina’s oil kept moving. That is the first thing the operator of the country’s main crude pipeline wanted people to know after telling the securities regulator that intruders had been inside its systems.

The second thing worth knowing is that the same attacker name has now surfaced twice in a fortnight, on two of South America’s most important oil networks.

What the pipeline operator actually said

Oleoductos del Valle, known as Oldelval, operates the pipeline system that moves crude out of Argentina’s Neuquén Basin. On Friday it filed what Argentine market rules call a hecho relevante – a material-event notice – with the Comisión Nacional de Valores, the securities regulator, disclosing that a cyberattack had affected some of its administrative systems.

The notice is narrow, and deliberately so. The company said it applied its cybersecurity protocol, restored all the systems that had been hit, and resumed normal administrative work. Crude transport, it said, continued without interruption for the duration. People at the company described the episode as fully contained.

What the company did not say is at least as notable. It has not described the type of threat, has not said how the attackers got in, and has not said what, if anything, was taken. It says it is still assessing the full scope and is making filings to the relevant authorities.

The same group claimed an attack on Colombia’s oil company

The attack was claimed online by a group calling itself The Gentlemen, which sells its software to other criminals under what the industry calls ransomware-as-a-service. Two weeks earlier the same name claimed a far more damaging intrusion at Ecopetrol, Colombia’s state-controlled oil company.

In that case, detected on 17 July, Ecopetrol says it stopped the attackers from encrypting its files but could not prevent them downloading data belonging to roughly 3,300 user accounts, along with cloud-stored material from 15 companies in its group. The attackers have claimed a far larger haul – a terabyte of documents – which Ecopetrol has not accepted. The company is working with Colombia’s prosecutors and its technology ministry to have the leaked files taken down.

One caution belongs here. A claim posted by a criminal group is not proof, and Oldelval has not endorsed it. Ransomware crews routinely claim attacks they did not carry out, and exaggerate the ones they did.

What is documented is the group’s scale. Colombia’s national cyber-emergency body has tied it to more than 200 attacks across 50 countries, and security researchers count several hundred victims worldwide since it appeared in the second half of 2025. It is consistently ranked among the most active ransomware operations now working.

Why a pipeline most readers have never heard of matters

Oldelval runs more than 1,700 kilometres of pipeline linking the Neuquén Basin fields to storage and export terminals at Puerto Rosales, near Bahía Blanca, and Punta Colorada. Argentine reporting puts the share of Vaca Muerta crude moving through that system at somewhere between 75% and 90%, depending on the measure used.

Its customers are effectively the whole industry: YPF, Vista Energy, Pan American Energy, Chevron, Shell, Tecpetrol, Pluspetrol, Pampa Energía and TotalEnergies. Several of them are also shareholders.

The timing gives the episode its weight. Crude has just overtaken corn and soy meal to become Argentina’s largest single export, a structural change in an economy that has fed the world for a century. The pipeline that carries it is now a single point of failure under the country’s main foreign-currency earner – and it has just been shown to be reachable.

The company is in the middle of expanding it. A new 207-kilometre line called Duplicar Norte, costing an estimated US$380 million, will connect pumping stations at Puesto Hernández in Neuquén and Allen in Río Negro. Early operation is planned for the end of 2026, with full commissioning expected in the first quarter of 2027.

What is still unknown

Three questions remain open, and none of them can be answered from the filing. How the attackers got in. Whether any data left the building. And whether administrative systems were genuinely the limit of the intrusion, or simply the limit of what has been disclosed so far.

The distinction between administrative networks and the control systems that actually move oil is the one that matters. In the 2021 attack on Colonial Pipeline in the United States, the operator shut its pipeline down as a precaution even though the intruders had reached only the business side. Fuel supply on part of the US east coast was disrupted for a week. Oldelval says it did not need to make that choice.

Frequently Asked Questions

Did the attack stop any oil from moving?

No. Oldelval told the securities regulator that crude transport ran without interruption throughout, and that the incident was confined to administrative systems. The company says every affected system has been restored.

Who was behind it?

That is not established. A ransomware group calling itself The Gentlemen claimed the attack online. Oldelval has not confirmed who was responsible, has not described how the attackers got in, and has said only that a foreign origin looks more likely than a local one.

Why does this pipeline matter outside Argentina?

It is the artery between the Vaca Muerta shale field and the export ports. Crude has just become Argentina’s single biggest export, ahead of corn and soy meal, and almost all of it travels through this network on its way to the coast.

Sources: Oldelval material-event filing to the Comisión Nacional de Valores · Infobae · Ecopetrol statements · ColCERT

This article was produced by The Rio Times’ automated newsroom system. How we use AI · Report an error