W&T Offshore has hired Skadden, Arps, Slate, Meagher & Flom to conduct an internal investigation of management’s close relationship with information-technology vendor AAIT, according to people with knowledge of the situation.
The offshore driller began the probe after receiving a whistle-blower letter on the matter, said the people, who asked not to be identified because the details are private.
Last month, W&T’s newly hired chief information officer and general counsel collected laptops and information for the investigation, the people said. Some employees received an email seeking all materials on services and policies tied to IT, the people said.
Lawyers at Skadden have also been interviewing former and current employees at Houston-based W&T, they said.
The US Securities and Exchange Commission is stepping up scrutiny on how public companies manage cybersecurity risk management, governance and reporting to investors.
In an emailed statement Wednesday, W&T referred to recent filings with the SEC and said that a recent review of its IT systems, carried out with the help of independent external experts, “found no material impact on our financial results or operational performance.
“We did find opportunities for improvements to bring our IT practices in line with industry best practices, and we have already begun implementing more rigorous processes accordingly,” W&T said.
W&T was founded in 1983 by Tracy Krohn, who spent years in the oil patch and also on the racing track. It operates in the Gulf of Mexico.
In its second-quarter filings, W&T disclosed its operations could be hampered by cybersecurity incidents and that its third-party IT service provider didn’t align with customary industry practices.
The driller said in a filing it doesn’t have any written agreements with its primary service provider, without naming the company. W&T is currently remediating the identified issues, including hiring a new CIO and transitioning away from certain legacy systems and service providers, the company said.
W&T’s primary IT service provider notified the company it plans to cease services by Sept. 2, according to a filing. The end of services could affect the driller’s ability to monitor production and prepare results in a timely fashion.
W&T also entered into indemnification agreements with each of the company’s directors and officers on Aug. 8. This gives broader protection to W&T’s officers and directors in case the company faces lawsuits and regulatory inquiries, the people said.
AAIT said in a statement that it has successfully managed W&T’s IT infrastructure and “was surprised and disappointed to see many of the statements included in W&T’s recent 10-Q filing.”
“AAIT is not aware of any particular concern W&T has with AAIT’s security protocols, and no issue has been raised by W&T to AAIT,” it said. “AAIT does not have a written contract with W&T and it has provided the services described above for years under nothing more than a handshake.”
“On August 3, 2022, AAIT was finally fed up with the internal politics of W&T and the daily demands of its outside counsel that it issued a termination letter for its services,” the company said. “Unless the parties change their current course, AAIT plans to terminate all services to W&T on September 2.
Shares of W&T closed 2.2% higher at $5.63 in New York.
Recommended for you
