Cyber-attack on petrol pumps: Why hackers aim infrastructure

In late October this year, Iran's president informed media about a cyber-attack that disrupted gas station services across the country. Long lines formed outside the petrol pumps, where government-issued cards stopped working. The attack barred thousands of people from buying subsidized fuel. The attack in Iran was days apart form a cyber-attack on investor identity documents in India. Attacks like this have gone up tremendously all over the world, especially during the pandemic years. Why are the hackers and criminals aiming at infrastructure?  

Why are infra-attacks a major threat to all?  
In the past 5 years, cyber threats and ransomware attacks have spiked. During the COVID-19 pandemic, a lot of services moved parts of their business online, making more data available to criminals. Cyber threats are now aimed at large-scale destruction rather than quick monetary profit. When an infra-attack happens, national security is on stake, and attackers can demand massive ransoms form countries, corporations or even terrorist outfits. Water, energy, fuel networks and financial organisations are at maximum risk.  

Are we individually affected by cyber-attacks on infra?  
Cyber-attacks on national critical infrastructure not only pose risk to economic security and infrastructure assets of a country, but also impact us at a personal level. Our personal data, finances, assets, and even daily well-being may be endangered. Imagine receiving water laced with toxins since the toxicity removal plant has been attacked, or suddenly realising that banking surcharges you did not look at closely has sucked out a large amount from your account.  

Why is it tough to detect and stop the attacks?  
The biggest challenge to enforcing security is that most of critical infrastructure is privately owned by large corporations. There is no government enforcement, incentives, or penalisation for not being cyber secure for these companies.  

What can be done to reduce the attacks?  
Cyber security must be made a priority for the critical infrastructure industry, as it involves both national security and community well-being. The level of concern over security continues to be surprisingly low till enforcements are put in place. The awareness about attacks is there, but no one wants to take them seriously till they happen.