Data Recovery Digest

No matter how you look at it, 2021 just hasn’t been a great year for providers of public utilities in the United States. While there’s always the normal, run-of-the-mill issues that just come with the territory, this past year has been an exceptional one to say the least.

The problems really ramped up in May 2021. When a ransomware attack targeting the Colonial Pipeline effectively shutdown oil distribution throughout the eastern United States, public officials knew they were facing an all-new issue that never really threatened them before – at least not to that scale.

Unfortunately, it seems their worst fears are becoming reality as the details of three additional ransomware attacks – all of which targeted different water treatment plants in the country – were disclosed to the public.

One of the attacks, which took place in March, happened prior to the Colonial Pipeline incident. The other two attacks occurred in July and August. It’s also important to note that all of the attacks targeted different facilities and even took place in different states. With attacks coming in Nevada, Maine, and California, respectively, it’s easy to see how widespread of an issue ransomware is becoming – especially when it targets public utilities.

A Troubling Trend

You don’t have to look far to see a sharp increase in the overall number of reported ransomware incidents in the United States, but what about the unreported incidents? After all, if this single report is disclosing three separate incidents for the very first time, one could reasonably assume that there are other unreported incidents, too.

With that in mind, we can only focus on the incidents that have actually been reported. According to recent news, the March 2021 involved an unknown or unidentified ransomware app to target a WWS (waste and wastewater system) facility in Nevada. The ransomware ultimately made its way into the targeted system’s SCADA framework, which is used for data backup, visibility, and monitoring.

In July 2021, the ZuCaNo ransomware app was introduced into a WWS facility in Maine. Once again, it targeted the SCADA framework, which caused the entire plant to go into manual treatment operations until the system was restored to its fully functional state.

Yet another type of ransomware, known as Ghost, made its way into a WWS facility in California. It took IT experts almost an entire month before they even noticed the infection, at which point their SCADA servers were effectively taken over.

Although the report doesn’t necessarily indicate an increase in ransomware attacks against WWS facilities specifically, it does synchronize with the increases in ransomware we’ve seen in other areas. Moreover, it highlights just how susceptible these services are to modern threats like ransomware, viruses, hackers, and other malicious users.

Regardless of how you look at it, this is a troubling trend to say the least. Not only does it make you question the current state of IT security across all industries and sectors, but it raises serious concerns about our ability to safeguard systems against hackers and other malicious actors in the future.