Real-World Examples of Hacks and Breaches in the Utilities and Energy Industry
Learn from these unfortunate and costly cyber attacks and prevent security incidents at your organization.
For businesses in the energy sector, hacks and breaches are both common and costly. For hackers, the utilities and energy industry has the perfect ingredients for an impactful cyberattack:
- The amount of data to be stolen is substantial. Energy and utilities organizations work with vast personnel, including large staff and a huge customer base. Not only does this give threat actors more data to collect, it also offers more opportunities to gain access through a single set of credentials.
- Digital and cloud-based systems are increasingly common. As the utilities and energy sector adapts to use smart technology, these systems become both more efficient and more vulnerable. It’s easier to hack into online systems like power grids and water plants, which can have dire real-world consequences.
- Energy and utilities organizations are more likely than other industries to pay hackers a ransom to retrieve their data.
Read on to learn about three recent security incidents in the energy and utilities sector, and discover how your organization can prevent these types of attacks.
#1: The ransomware attack on Colonial Pipeline
Who was affected: In 2021, the largest petroleum pipeline in the United States was hit with a ransomware attack, cutting off gas supply across the East Coast.
The cost: The hackers demanded a $4.4 million ransom in bitcoin, which was later partially recovered by the Department of Justice.
How they did it: Using credentials included in a batch of logins found on the dark web, threat actors hacked into Colonial Pipeline’s system through a VPN.
The takeaway: Signing up for dark web monitoring, which can be automated through Dashlane, means that you’ll be notified if your passwords show up as part of a data leak. This gives organizations the opportunity to change passwords and logins, preventing hackers from gaining access to company networks. Our password manager also helps to eliminate reused passwords; Dashlane will notify employees and admins if a password is weak or has been used for another account.
Want to learn more about using a password manager and how your company might benefit? Watch this video.
#2: The hack of a water treatment plant
Who was affected: In February of 2021, hackers tried to poison the water supply of a small water treatment plant in Florida.
The cost: Luckily, an employee was able to stop the attack once they realized the system was being manipulated—but the threat actors still gained access to the system.
How they did it: The hackers logged in to the treatment plant’s supervisory control and data acquisition system (SCADA) remotely. The system ran on an unsecured version of Windows, and employees connected to the remote-access software through one password they all shared. The company also neglected to use a firewall for employees to connect.
The takeaway: Shared passwords can be a culprit of breaches and hacks, especially if those passwords are shared through unsecured methods. Dashlane allows employees to share passwords securely through the browser and mobile app to access a shared account, and employees should be discouraged from sharing a single password to access a remote desktop. Instead, each employee should have their own login, and connect through a firewall.
#3: The ransomware attack on Energias de Portugal (EDP)
Who was affected: One of the largest energy providers in Europe, Portugal’s EDP, was the victim of a ransomware attack in April of 2020.
The cost: EDP serves 11 million customers and employs 11,500 people. Cyberattackers stole 10 terabytes of data including sensitive customer information and employee credentials in addition to demanding $11 million in ransom.
How they did it: It’s likely that the threat actors used a stolen password to access EDP’s servers then deployed the ransomware attack.
The takeaway: For hackers, the easiest way into a company’s network is by using compromised credentials. Though a reused or weak password may seem insignificant, the consequences can be devastating to an organization’s assets and reputation. Part of enhancing your company’s cybersecurity culture is to impress upon employees the necessity of strong passwords that are stored securely. It’s also essential for companies to use multifactor authentication for all logins. With MFA, even if a hacker does get their hands on your passwords, their access will be blocked by further authentication steps.
Want to learn more?
Learn how energy and utility providers can mitigate cyber threats and prevent data breaches and hacks by downloading our free Password Playbook for Utility and Energy Providers.
Sign up to receive news and updates about Dashlane
