A regional energy operator says it has contained a ransomware attack that forced it to run its distribution network from standby control systems for 19 hours.
The intrusion began on an internet-facing remote access server and spread to office systems before engineers isolated the operational network. Power delivery was not interrupted.
An affiliate group listed the operator on its leak site the same afternoon. The company says its forensic review has so far found no evidence that customer data was taken.
What to do
- Check remote access servers for unexpected accounts and sessions.
- Confirm that office and control networks are separated and that the separation is tested.