Automatic Tank Gauging (ATG) systems play a critical role in fuel operations, providing visibility into tank inventory, fuel levels, temperature, and leak detection. These systems help site operators manage fuel safely and efficiently. However, recent cybersecurity incidents have highlighted the importance of ensuring ATGs are configured and accessed securely.

Why This Matters

Federal cybersecurity agencies, including the Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and National Security Agency (NSA), recently warned that cyber threat actors have been targeting internet-exposed ATG systems across the United States. According to the agencies, attackers have gained access to ATGs that were directly connected to the internet and, in some cases, modified system displays or settings. While reported incidents have not resulted in physical damage, they demonstrate how vulnerable these systems can become when not properly secured.

The concern is not only unauthorized access. If an ATG system is compromised, an attacker could potentially interfere with monitoring functions, making it more difficult to identify issues such as leaks, inventory discrepancies, or other operational concerns. Federal guidance notes that compromised ATG systems can increase the risk of environmental hazards, operational disruptions, and safety incidents.

A Growing Target

Recent reports have linked several ATG-related cyber incidents to suspected threat actors who sought out systems that were exposed to the public internet without adequate security controls. Investigators found that many of the targeted systems were accessible using default credentials or lacked password protection altogether. These incidents serve as a reminder that critical operational technology can become a target when basic cybersecurity protections are not in place.

Cybersecurity experts have emphasized that ATGs were originally designed for operational monitoring and were not intended to be directly exposed to the internet. As remote access needs have increased, some organizations have inadvertently created opportunities for unauthorized access by connecting these systems without appropriate security measures.

Best Practice: Never Connect an ATG Directly to the Internet

The most important takeaway from recent federal guidance is simple:

Do not connect your ATG directly to the internet.

CISA, NSA, and their government partners specifically recommend removing ATG systems from direct internet exposure and implementing secure methods for remote access.

If remote monitoring or support is required, site operators should work with their Managed Network Service Provider (MNSP) or technology provider to implement a secure remote access solution. This may include network segmentation, secure gateways, virtual private networks (VPNs), multifactor authentication, and other security controls designed to protect operational technology systems.

Steps Site Operators Should Take

To help reduce cybersecurity risk, site operators should:

• Confirm that ATG systems are not directly connected to the public internet.
• Work with your MNSP before enabling any remote access capabilities.
• Change default passwords and implement strong authentication practices.
• Review user access regularly and remove unnecessary accounts.
• Monitor system logs and investigate unusual activity.
• Ensure ATG software and supporting infrastructure are maintained according to vendor recommendations.

Cybersecurity Is Part of Site Readiness

As fuel retail technology becomes increasingly connected, cybersecurity is an important part of protecting operations, customers, and business continuity. A secure ATG environment helps ensure accurate fuel monitoring, reliable leak detection, and uninterrupted site operations.

If you currently access your ATG remotely or are considering enabling remote access, contact your qualified cybersecurity advisor or MNSP to review your remote access solution and discuss more secure options if warranted. Taking proactive steps today can help reduce risk and keep critical fuel management systems protected.

Reminder: Never connect an ATG directly to the internet. Always work with your MNSP to implement secure remote access solutions.