Hackers publish over 4,000 files stolen from SEPA in ransomware attack
1.2GB of data was taken from the Scottish regulator's digital systems on Christmas Eve
Cyber criminals have published more than 4,000 files belonging to the Scottish Environment Protection Agency (SEPA).
The regulator fell victim to a hack on Christmas Eve, which saw around 1.2GB of data stolen from its digital systems, including databases, contracts, and strategy documents.
The incident has been claimed by the Conti ransomware group, which is considered the successor of the notorious Ryuk strain that was for a third of all ransomware attacks in 2020.
SEPA refused to pay the ransom, with its chief executive Terry A’Hearn saying that the regulator “won’t use public finance to pay serious and organised criminals intent on disrupting public services and extorting public funds”.
“We have made our legal obligations and duty of care on the sensitive handling of data a high priority and, following Police Scotland advice, are confirming that data stolen has been illegally published online.”
A’Hearn added that SEPA is “working quickly with multi-agency partners”, including the Scottish Government, Police Scotland, and the National Cyber Security Centre (NCSC), to “recover and analyse data then, as identifications are confirmed, contact and support affected organisations and individuals”.
Detective inspector Michael McCullagh of Police Scotland’s Cybercrime Investigations Unit said that the investigation remains “ongoing”.
RELATED RESOURCE
Ransomware protection with Veritas NetBackup Appliances
How to use Veritas NetBackup and NetBackup Appliances to protect against and recover from ransomware attacks
“Police Scotland are working closely with SEPA and our partners at Scottish Government and the wider UK law enforcement community to investigate and provide support in response to this incident. Enquiries remain at an early stage and continue to progress including deployment of specialist cybercrime resources to support this response,” he added.
The Christmas Eve attack saw the environmental regulator experience a “significant systems outage” which affected its contact centre, phone lines, and email.
“Sadly we’re not the first and won’t be the last national organisation targeted by likely international crime groups. We’ve said that whilst for the time being we’ve lost access to most of our systems, including things as basic as our email system, what we haven’t lost is our twelve-hundred expert staff,” added A’Hearn.
SEPA’s regulated business and supply chain partners are able to access Police Scotland guidance and an enquiry form through a dedicated data loss support website, with a support line also available.
-
Tomorrow's fraud techniquesITPro Podcast Leaders need to proactive as attackers launch more consistent, sophisticated attacks
-
Met Office hails huge efficiency gains in first year of cloud supercomputing with Microsoft AzureNews In moving to the cloud, the Met Office has bolstered operational resilience and helped to deliver more accurate forecasts
-
The rise of teen hackers ‘makes for a good headline’, but cyber crime activities peak later in lifeNews With family responsibilities and mortgages to pay, it's not teenagers dishing out malware or carrying out cyber extortion
-
Ransomware gangs are using employee monitoring software as a springboard for cyber attacksNews Two attempted attacks aimed to exploit Net Monitor for Employees Professional and SimpleHelp
-
Ransomware gangs are sharing virtual machines to wage cyber attacks on the cheap – but it could be their undoingNews Thousands of attacker servers all had the same autogenerated Windows hostnames, according to Sophos
-
Google issues warning over ShinyHunters-branded vishing campaignsNews Related groups are stealing data through voice phishing and fake credential harvesting websites
-
The FBI has seized the RAMP hacking forum, but will the takedown stick? History tells us otherwiseNews Billing itself as the “only place ransomware allowed", RAMP catered mainly for Russian-speaking cyber criminals
-
Everything we know so far about the Nike data breachNews Hackers behind the WorldLeaks ransomware group claim to have accessed sensitive corporate data
-
There’s a dangerous new ransomware variant on the block – and cyber experts warn it’s flying under the radarNews The new DeadLock ransomware family is taking off in the wild, researchers warn
-
Hacker offering US engineering firm data online after alleged breachNews Data relating to Tampa Electric Company, Duke Energy Florida, and American Electric Power was allegedly stolen
