Scotland Environmental Regulator Hit By ‘Ongoing’ Ransomware Attack

The Scottish Environment Protection Agency (SEPA) confirmed on Thursday that some of its contact center, internal systems, processes and internal communications were affected following a ransomware attack that took place on Christmas Eve.

“SEPA confirms ongoing ransomware attack likely to be by international serious and organised cyber-crime groups intent on disrupting public services and extorting public funds,” the agency said.

SEPA added that, after isolating the compromised systems, recovery will probably take “a significant period” and some of the infected SEPA systems will have to be replaced with new ones.

Email systems have also been impacted by the Xmas Eve ransomware attack and are still down, with some internal systems and external data products to be offline in the short term.

“[E]mail, staff schedules, a number of specialist reporting tools, systems and databases remain unavailable with the potential for access to a series of systems and tools to be unavailable for a protracted period,” SEPA said.

However, the agency reassured the public that priority regulatory, monitoring, flood forecasting, and warning services still operational despite the attack’s aftermath.

Also Read: Limiting Location Data Exposure: 8 Best Practices

This remains an ongoing investigation. Police Scotland are working closely with SEPA and our partners at Scottish Government and the wider UK law enforcement community to investigate and provide support in response to this incident. Enquiries remain at an early stage and continue to progress including deployment of specialist cybercrime resources to support this response. “It would be inappropriate to provide more specific detail of investigations at this time. — Detective Inspector Michael McCullagh of Police Scotland’s Cybercrime Investigations Unit

Stolen files leaked by Conti ransomware

While SEPA didn’t attribute the attack to any specific ransomware operation, the Conti ransomware gang claims the attack and has already published 7% of the stolen data on its leak site.

Roughly 1.2 GB of data was exfiltrated during the attack according to SEPA, with evidence showing that at least 4,000 files were probably accessed and stolen.

“Whilst we don’t know and may never know the full detail of the 1.2 GB of information stolen, what we know is that early indications suggest that the theft of information related to a number of business areas,” SEPA’s Chief Executive Terry A’Hearn said.

“Some of the information stolen will have been publicly available, whilst some will not have been.”

The information stolen by the Conti operators during the attack includes:

• Business information: Information such as, but perhaps not restricted to, publicly available regulated site permits, authorisations and enforcement notices. Some information related to SEPA corporate plans, priorities and change programmes.
• Procurement information: Information such as, but perhaps not restricted to, publicly available procurement awards.
• Project information: Information related to our commercial work with international partners.
• Staff information: Personal information relating to SEPA staff.

SEPA is currently working with cybersecurity specialists and experts from multi-agency partners including Police Scotland and the National Cyber Security Centre on eradication, remediation, and recovery tasks.

“Whilst having moved quickly to isolate our systems, cyber security specialists, working with SEPA, Scottish Government, Police Scotland and the National Cyber Security Centre have now confirmed the significance of the ongoing incident,” A’Hearn added.

Also Read: 10 Practical Benefits of Managed IT Services

“Partners have confirmed that SEPA remains subject to an ongoing ransomware attack likely to be by international serious and organised cyber-crime groups intent on disrupting public services and extorting public funds.”