Commission des services electriques de Montréal (CSEM) suffered the attack at the hands of the ransomware gang called Lockbit this past Wednesday which said it “added Commission des services electriques de Montreal to their victim list.”
The electric provider said in an advisory it was hit with ransomware on August 3 but refused to pay the ransom.
As soon as it discovered the attack, the company contacted national authorities and law enforcement in Quebec while making every effort to restore its systems, it said in the advisory.
The company said it already restored its IT infrastructure.
“The criminal group at work in this case has made public today some of the stolen data. The CSEM denounces this illegal gesture, while specifying that the data disclosed represents a low risk for both the security of the public and for the operations carried out by the CSEM,” they said in the advisory.
“It should be noted that all CSEM projects are the subject of public documents. Therefore, all these plans – engineering, construction and management – are already publicly available through the official process offices in Quebec.”
LockBit threatened to leak the data Wednesday, the same day it claimed the attack.
“Public utilities are critical to our day-to-day life, and while this attack acted as more of a warning shot, it reinforces the importance of cyber resilience for business continuity,” said Emily Phelps, director at security provider, Cyware. “Ransomware groups leverage their reputations to intimidate targets, and they adapt as security controls mature. Expediting threat intelligence and knowledge sharing can help mitigate the risks for enterprises. The sooner the right people get the right information about a known threat, the sooner they can adapt their defenses accordingly.”
“While the risk of data disclosure from this particular attack is low, as the company has pointed out, the attack nevertheless re-enforces the need for all critical infrastructure providers to protect themselves,” said Dave Ratner, chief executive at security provider, HYAS. “Attackers will continue to develop new ways to infiltrate and evade security systems; the deployment of business and operational resiliency systems, such as Protective DNS and others, is the best way to proactively ensure business continuity.”