Cyber criminals have published more than 4,000 files belonging to the Scottish Environment Protection Agency (SEPA).
The regulator fell victim to a hack on Christmas Eve, which saw around 1.2GB of data stolen from its digital systems, including databases, contracts, and strategy documents.
The incident has been claimed by the Conti ransomware group, which is considered the successor of the notorious Ryuk strain that was for a third of all ransomware attacks in 2020.
SEPA refused to pay the ransom, with its chief executive Terry A’Hearn saying that the regulator “won’t use public finance to pay serious and organised criminals intent on disrupting public services and extorting public funds”.
“We have made our legal obligations and duty of care on the sensitive handling of data a high priority and, following Police Scotland advice, are confirming that data stolen has been illegally published online.”
A’Hearn added that SEPA is “working quickly with multi-agency partners”, including the Scottish Government, Police Scotland, and the National Cyber Security Centre (NCSC), to “recover and analyse data then, as identifications are confirmed, contact and support affected organisations and individuals”.
Detective inspector Michael McCullagh of Police Scotland’s Cybercrime Investigations Unit said that the investigation remains “ongoing”.
RELATED RESOURCE
Ransomware protection with Veritas NetBackup Appliances
How to use Veritas NetBackup and NetBackup Appliances to protect against and recover from ransomware attacks
“Police Scotland are working closely with SEPA and our partners at Scottish Government and the wider UK law enforcement community to investigate and provide support in response to this incident. Enquiries remain at an early stage and continue to progress including deployment of specialist cybercrime resources to support this response,” he added.
The Christmas Eve attack saw the environmental regulator experience a “significant systems outage” which affected its contact centre, phone lines, and email.
“Sadly we’re not the first and won’t be the last national organisation targeted by likely international crime groups. We’ve said that whilst for the time being we’ve lost access to most of our systems, including things as basic as our email system, what we haven’t lost is our twelve-hundred expert staff,” added A’Hearn.
SEPA’s regulated business and supply chain partners are able to access Police Scotland guidance and an enquiry form through a dedicated data loss support website, with a support line also available.
-
AWS says new ‘frontier agents’ will transform software developmentNews A new class of AI agents promises days of autonomous work and added safety checks
-
Channel focus: All you need to know about VMware's partner programChannel Focus Parent company continues to choose a fresh direction in a bid to increase partner capabilities and value to customers
-
15-year-old revealed as key player in Scattered LAPSUS$ HuntersNews 'Rey' says he's trying to leave Scattered LAPSUS$ Hunters and is prepared to cooperate with law enforcement
-
The Scattered Lapsus$ Hunters group is targeting Zendesk customers – here’s what you need to knowNews The group appears to be infecting support and help-desk personnel with remote access trojans and other forms of malware
-
Impact of Asahi cyber attack laid bare as company confirms 1.5 million customers exposedNews No ransom has been paid, said president and group CEO Atsushi Katsuki, and the company is restoring its systems
-
The US, UK, and Australia just imposed sanctions on a Russian cyber crime group – 'we are exposing their dark networks and going after those responsible'News Media Land offers 'bulletproof' hosting services used for ransomware and DDoS attacks around the world
-
A notorious ransomware group is spreading fake Microsoft Teams ads to snare victimsNews The Rhysida ransomware group is leveraging Trusted Signing from Microsoft to lend plausibility to its activities
-
Volkswagen confirms security ‘incident’ amid ransomware breach claimsNews Volkswagen has confirmed a security "incident" has occurred, but insists no IT systems have been compromised.
-
The number of ransomware groups rockets as new, smaller players emergeNews The good news is that the number of victims remains steady
-
Teens arrested over nursery chain Kido hacknews The ransom attack caused widespread shock when the hackers published children's personal data
