Saudi Aramco fell prey to a ransomware attack in July 2021 that slightly disrupted its operations. The attackers gained the access to its systems and stole some of the company's files. Apparently, hackers had about 1 terabyte of Saudi Arabian Oil Co. data and demanded a ransom of about $50 million in cryptocurrency to delete it.

In August 2017, the Petro Rabigh complex, part-operated by Saudi Aramco, experienced a significant cybersecurity incident involving the Triton malware. This malware targeted Schneider Electric safety equipment within the facility, leading to the shutdown of part of the complex. The attack was distinguished by its sophistication, targeting the safety systems designed to prevent catastrophic industrial accidents. The Triton malware attack not only signaled a new chapter in cyber warfare aimed at industrial control systems but also demonstrated the potential for causing physical damage and even loss of life. The attack was later attributed with high confidence to a state-backed actor, showcasing the evolving landscape of cyber threats to critical infrastructure around the globe. The incident underscored the necessity for heightened cybersecurity measures and resilience against sophisticated cyberespionage tools targeting industrial safety and control systems.