United Kingdom water provider Southern Water has disclosed that it incurred prices of £4.5 million ($5.7M) attributable to a cyberattack it suffered in February 2024.
Southern Water is a non-public utility firm in southern England, offering water providers to 2.7 million prospects and wastewater providers to over 4.7 million prospects throughout Kent, Sussex, Hampshire, and the Isle of Wight.
The firm provides 570 million liters of water via a 13,973 km community every day and manages 1,522 million liters of wastewater by way of a 40,058 km sewer system.
Roughly a yr again, Southern Water introduced that it suffered a safety breach, which did not affect its operations, monetary programs, or customer-facing programs.
The assault was claimed by the Black Basta ransomware gang, a infamous risk actor recognized for not hesitating to assault crucial infrastructure.
The firm’s monetary report, first seen by DataBreaches.internet, determines the price of the Black Basta assault to be round £4,500,000 (web page 98).
“In February 2024 we introduced that information from a restricted a part of our server property had been stolen via an unlawful intrusion into our IT programs,” reads the report.
“We engaged exterior cyber safety specialists and authorized advisers in response, in addition to contacting anybody whose private information might have been in danger.”
“We have incurred £4.5 million in responding to this distinctive incident in the course of the yr.”
For perspective, the quantity is similar as Southern Water paid for air pollution administration operations final yr, not accounting for the reputational injury, authorized charges, and potential regulatory scrutiny that will accompany cybersecurity incidents.
Source: Southern Water
Southern Water claims that it has contracted cybersecurity specialists to repeatedly monitor the darkish net for information leaks impacting them or their purchasers, which has not occurred but.
Meanwhile, evaluation of the leaked inner chat logs from the Black Basta ransomware gang revealed that the water remedy firm allegedly proposed to pay the ransomware actors £750,000 ($950k) on February 12, 2024.
Although the attackers initially demanded a cost of $3,500,000, by the top of February 2024, the corporate’s entry was faraway from Black Basta’s extortion web site, indicating that the 2 might need reached some settlement.
When requested by The Register if the corporate paid the ransomware gang, a spokesperson repeated previous statements that didn’t make clear something.