Electrica Group announces that it is undergoing a cyber attack and that specialists are closely collaborating with cyber security authorities to manage and remediate the incident.
The Group specifies that critical systems are not affected and advises customers to be vigilant about any suspicious messages received in the company’s name and not to provide personal data through unsecured channels.
The Romanian Ministry of Energy specifies that, from initial investigations, it appears to have been a ransomware attack. Network equipment has been lifted and is unaffected, and the SCADA system is isolated and fully functional.
Electrica is the largest energy provider and distributor in Romania, present in 18 counties.
Electrica Announcement
”Specialist teams are closely collaborating with national authorities in the field of cyber security to manage and remediate the incident, aiming to resolve the situation as quickly as possible, identify the source of the attack, and limit its impact.
We want to emphasize that critical systems of the group are not affected, and any malfunctions in our interaction with consumers are effects of internal infrastructure protection measures. These measures are temporary and aim to ensure the security of the entire system,” the company announces, without specifying the source of the attack.
At this moment, all specific response protocols have already been activated according to internal procedures and current regulations.
”Our main priority is to maintain continuity in the distribution and supply of electricity, as well as to protect the personal data managed and operational data of all entities within the Electrica Group.
We will continue to inform the public about the evolution of the situation and the measures taken to remedy it. In this context, we recommend our consumers to be cautious about any suspicious messages received in the company's name and to avoid providing personal data through unsecured channels,” emphasizes Electrica.
Ministry of Energy Statement
The Ministry of Energy specifies that a detailed technical analysis has been initiated, and hashes have been collected to identify the content and possible origin of the attack.
Servers are to undergo rigorous checks, and data backups are isolated and safe.
From initial investigations, it appears to have been a ransomware attack. Network equipment has been lifted and is unaffected, and the SCADA system is isolated and fully functional.
The institution also presents the measures adopted. Thus, specialized teams have taken over the digital artifacts resulting from the attack to determine its source.
”We reiterate the urgent need to adopt the emergency ordinance regarding the establishment and operationalization of the Cyber Security Incident Response Center in Energy (CRISCE). The project is currently under inter-ministerial review at the Ministry of Finance and the Ministry of Labor and Social Solidarity. CRISCE will have the necessary resources and personnel for preventing, managing, and deterring these attacks, ensuring the energy security of Romania,” emphasizes the Ministry of Energy.
The Ministry also points out that a ransomware attack is a cyber attack in which hackers use malicious software to block access to the victim's data or systems through encryption. Subsequently, they demand a ransom, usually in cryptocurrencies, to provide the decryption key needed to recover the data.
In short: The attacker infects the system with ransomware. Data is encrypted, becoming inaccessible. The victim receives a message demanding a sum of money to regain access to the data.
Ransomware can infiltrate the system through phishing emails, compromised websites, or software vulnerabilities. It is one of the most common and dangerous cyber threats.
Electrica Group is a key player in the distribution, supply, and production of electricity in Romania, as well as one of the largest players in the energy services sector. Electrica Group serves approximately 4 million users and has a national coverage - organized into three areas for electricity distribution: Northern Transylvania, Southern Transylvania, Northern Muntenia, and nationwide for electricity supply and maintenance and energy services.
Since July 2014, Electrica has been a majority privately-owned company, listed on the stock exchanges in Bucharest and London. Electrica is the only Romanian company listed in the field of electricity distribution and supply.