Saudi Aramco 1TB Third-Party Data Leak

🇸🇦 Saudi PDPLJune 20219 min read

# Saudi Aramco: 1TB Third-Party Data Leak Exposes 14,000 Employees

In June 2021, a threat actor operating under the alias "ZeroX" posted a 1-terabyte sample

of Saudi Aramco's internal data on a dark web marketplace, demanding a $50 million ransom

in cryptocurrency. The data was exfiltrated not through Aramco's own infrastructure, but

through a compromised third-party contractor, exposing records of approximately 14,000

employees along with sensitive network schematics and proprietary engineering blueprints.

Aramco confirmed the data breach originated from a contractor system and stated that it

had no impact on its operations, though the scale of the leak represented one of the

largest data exposures in the Gulf energy sector's history.

## Key Facts

• .**What:** 1TB of Aramco data leaked via compromised contractor; $50M ransom demanded.
• .**Who:** Saudi Aramco and approximately 14,000 employees.
• .**Data Exposed:** Employee profiles, network schematics, SCADA data, and engineering blueprints.
• .**Outcome:** Aramco confirmed third-party origin; no operational impact reported.

## What Was Exposed

• .Full employee profiles for approximately 14,254 staff members, including names,

employee IDs, photographs, job titles, departmental assignments, and internal

email addresses

• .Network infrastructure diagrams and IP address schemas covering Aramco's internal

IT and operational technology environments

• .Engineering blueprints and technical specifications for refinery and drilling

infrastructure, some marked as proprietary

• .Third-party vendor contracts and invoices revealing supplier relationships and

pricing structures

• .Internal communications and project documentation spanning multiple business

divisions

• .SCADA system configuration data and network topology maps for operational

technology environments

The leaked data was organized into clearly labeled directories, suggesting the threat

actor had sustained access over a period of time and methodically exfiltrated and

categorized the information. ZeroX initially offered a 1GB sample for free as proof

of the breach, then listed the full 1TB dataset at a negotiable starting price of

$5 million. The countdown timer on the dark web listing and the structured marketing

approach indicated a sophisticated extortion operation rather than an opportunistic

smash-and-grab attack.

The employee data alone constituted a significant exposure. With 14,000 profiles

containing photographs, internal IDs, and departmental information, the dataset

provided a comprehensive organizational map of the world's most valuable energy

company. This information could be weaponized for spear-phishing campaigns, social

engineering attacks, or even physical security threats against identifiable employees

in sensitive operational roles.

Perhaps most concerning were the network blueprints and SCADA-related documentation.

Saudi Aramco had previously been the target of the devastating Shamoon malware attack

in 2012, which destroyed 35,000 workstations. The exposure of network architecture

details in 2021 effectively handed adversaries an updated roadmap to the company's

digital infrastructure, lowering the barrier for future attacks against both IT and

operational technology environments.

The involvement of a third-party contractor as the point of compromise is a recurring

theme in critical infrastructure breaches. Aramco invests billions in its own

cybersecurity program, but the security of its data ultimately depends on every entity

in its supply chain. The ZeroX breach demonstrated that a single contractor with

insufficient security controls can undermine the entire security posture of even the

most well-resourced organization.

## Regulatory Analysis

While Saudi Arabia's Personal Data Protection Law (PDPL) was not formally enacted

until September 2023, this breach illuminates precisely the kind of third-party risk

the law was designed to address. Under the PDPL as it now stands, Saudi Aramco's

reliance on a contractor whose systems were the point of compromise would trigger

multiple obligations that organizations must now take seriously.

Article 10 of the PDPL governs the processing of personal data by third parties,

requiring data controllers to ensure that any entity processing data on their behalf

maintains adequate security measures. The law mandates that controllers remain

responsible for the actions of their processors, meaning Aramco would bear regulatory

responsibility for the contractor's failure regardless of where the technical

vulnerability existed. The contractor relationship should have been governed by a

data processing agreement specifying minimum security controls, audit rights, and

incident response obligations.

Article 14 establishes the requirement for appropriate technical and organizational

security measures to protect personal data. The exfiltration of 1TB of data through

a contractor's systems suggests a failure in network segmentation, data loss

prevention controls, and monitoring capabilities. Under the current PDPL framework,

SDAIA would evaluate whether the security measures in place were proportionate to

the sensitivity and volume of data being processed. Given Aramco's status as

critical national infrastructure, the expected standard of care would be

exceptionally high.

Article 19 addresses data breach notification, requiring controllers to notify SDAIA

when a breach occurs that may harm individuals. The exposure of 14,000 employee

records, including photographs and organizational details, clearly meets this

threshold. The notification must include the nature of the breach, the categories

and approximate number of data subjects affected, the likely consequences, and the

measures taken to address the breach. Aramco's public acknowledgment of the

incident, while measured, would need to be supplemented with formal regulatory

reporting under today's framework.

The penalty provisions under the PDPL allow fines of up to SAR 5 million

(approximately $1.33 million USD) per violation, with the possibility of doubling

for repeat offenses. For a breach of this magnitude involving multiple PDPL articles,

cumulative penalties could be significant. Additionally, SDAIA has the authority to

order the publication of violations, which for a company of Aramco's stature would

carry reputational consequences far exceeding any monetary fine.

## What Should Have Been Done

The Aramco breach is a textbook case of third-party risk management failure, and

the lessons apply to every organization that shares sensitive data with contractors,

vendors, or outsourced service providers. The first and most critical control should

have been a rigorous vendor security assessment program. Before granting any

contractor access to employee data, network diagrams, or engineering documents,

Aramco should have required evidence of security certifications (ISO 27001 at

minimum), conducted penetration testing of the contractor's environment, and

established continuous monitoring of the contractor's security posture through

automated risk scoring platforms.

Network segmentation and data compartmentalization should have limited the blast

radius of any single contractor compromise. There is no legitimate reason for a

third-party contractor to have simultaneous access to employee PII, network

architecture diagrams, and engineering blueprints. The principle of least privilege

should have been enforced both at the access control level and at the network

architecture level, with separate environments for different data classifications

and strict controls on data movement between zones.

Data Loss Prevention (DLP) solutions should have been deployed at every egress

point to detect and block the exfiltration of 1TB of data, a volume that should

have triggered immediate alerts. Content-aware DLP systems can identify sensitive

data patterns, including employee records, technical diagrams, and classified

documents, and prevent their transmission outside approved channels. The absence

of effective DLP at the contractor's network boundary represents a critical gap

that enabled the full scope of the exfiltration.

Contractual safeguards should have included explicit data processing agreements

with the contractor, mandating specific security controls, regular audit rights,

mandatory breach notification within hours (not days), and clear liability

provisions. The agreement should have required the contractor to maintain cyber

insurance and to undergo annual third-party security assessments. These are not

aspirational best practices; they are standard requirements in mature vendor risk

management programs and are now effectively mandated by Article 10 of the PDPL.

Finally, Aramco should have maintained a comprehensive data inventory and

classification system that tracked exactly what data was shared with each

contractor, the legal basis for sharing it, and the retention period. When the

breach occurred, an up-to-date data map would have enabled rapid assessment of

exposure scope and facilitated timely notification to affected individuals. The

$50 million ransom demand, while ultimately unsuccessful, underscores that threat

actors understand the leverage created by poor data governance. Organizations that

know exactly what data exists and where it lives are far better positioned to

respond to extortion attempts from a position of informed decision-making rather

than uncertainty.

The Saudi Aramco breach demonstrates that for critical infrastructure operators,

the supply chain is the attack surface. No amount of perimeter hardening matters

if a contractor with access to 1TB of sensitive data operates without equivalent

security controls. Under Saudi Arabia's PDPL, the data controller cannot outsource

responsibility along with the data.