Suncor Energy Inc. (NYSE:SU) Q2 2023 Earnings Call Transcript

Page 3 of 10

Peter Zebedee: Yes. I think you saw that through the quarter where we’re flowing volumes and really keeping our upgraders full and optimizing the production network, the integrated production network within the region. This actually also extends into the downstream refining network that we have. Our — and this is something that we’ve got our teams focused on 24 hours a day, 7 days a week, really looking to generate the maximum benefits for the Company through placing volumes in the appropriate places. We’ve seen a significant benefit in flowing Fort Hills volumes into the base plant upgrader in terms of yield uplift. Are there opportunities to expand that? Yes, we have our development teams focused on looking at what other regional physical integration opportunities and the integration opportunities down into the downstream.

Rich Kruger: And Peter, that yield uplift is from PFT?

Peter Zebedee: Yes, from paraffinic froth treatment process. Yes.

Rich Kruger: And it’s material. I mean it makes a difference.

Peter Zebedee: It is material. Yes.

Operator: Thank you. One moment for our next question. And that will come from the line of Neil Mehta with Goldman Sachs.

Neil Mehta: Yes. Good morning, team. And Rich, this was very helpful color. I want to build on your comments on the cyber attack, and we were watching it from the outside. But maybe you can share some perspective with the investment community, if lessons learned and how your new team was able to take on this challenge and as we evaluate its ability to navigate challenges going forward?

Rich Kruger: Well, first of all, I’d rather have a root canal then go through one of these attacks again. They’re not pleasant at all. But let me start with the tail end. I was — look, we — I had been here a couple of months, Dave Oldreive in the Downstream was four days into his new job, and I’ve got to tell you, I saw Suncor management at its best in terms of the triggering, we call it different things, but I’d call it the business continuity plan, triggering that, putting it in motion, making decisive key decisions early in it. And that goes from the IT, as Peter led our internal business continuity efforts and I say it tongue in cheek, but June was our highest upstream production month of the year. So apparently, when the rest of us in Calgary were playing a Whack-a-Mole, here the organization just delivered.

And so, really pleased with that. Now, what I’d also say is we had a comprehensive rundown with our Board 1.5 weeks ago, and John Hill, our Senior VP of IT, I’ve said John is free to share lessons learned with his colleagues in the IT community. And what I’ve also said is I’m very comfortable talking to any of my colleagues on lessons learned. But I would say a few simple things, and these — these aren’t rocket scientists, we’re not the first and we’re not the last to go through a cybersecurity attack. But a quick action. And it’s like any emergency response. When in doubt, go the extra distance. It’s easy if you over respond and pull back. If you under respond or slow play things, it likely doesn’t turn out well. Then, the confidence in reestablishing a safe, secure IT environment.

And I’ll tell you, I’m not the only one around this table. But in the 3 or 4 days that followed, I learned more about IT hardware, software, interconnect, that I ever imagined I would in my life because you needed to understand that as we talked with John and his team to make informed decisions as the event unfolded. And so, fast response, decisive, building the safe, secure environment, and then, as you resume or restore operations, doing it very thoughtful, measured twice, cut once. And I’ll probably end my comments there. But it — wouldn’t want anyone to go through this. But if I were ever to go through it again, this is the team I would want to go through it with.

Page 3 of 10