A major public utility has been compromised by ransomware, something that those in the know in the Internet security arena have been fearing, and, indeed, have predicted. In this case, it was the Lansing, MI, Board of Water and Light, BWL. Fortunately, water and power service to customers was not affected by the attack.
“This was a very sophisticated virus that blew right through a number of our security systems,” Trent Atkins, Director of Emergency Management for the Lansing Board of Water and Light said.
Last Monday, April 25, the utility’s corporate computer network was virtually shut down, with email, computers, printers, phones and other technology on the administrative side unable to function. As of the following Monday, May 2, however, the systems were up and running again.
According to the Lansing State Journal, separation in the utility’s network system kept the delivery of services available and protected customer and employee data. For a brief period, customers were unable to report outages, but an alternate phone number was quickly set up to facilitate reporting.
The ransomware was delivered via a phishing attack, although officials have not made public the specific virus involved. Local law enforcement, as well as the FBI and security experts, are investigating the attack, according to BWL officials. No information has been released about the amount of ransom demanded or whether it was paid.
Michigan State University Associate Professor for the School of Criminal Justice Dr. Thomas Holt said the individual issuers behind these phishing attacks are getting more and more creative about who they target and how.
“Ransomware is not something that just affects businesses, it does affect you and I and it is something that is evolving,” Dr. Holt said.
There are solutions that can protect against ransomware, and this is a case in which prevention is definitely better than the cure. In the past, security has been based on a default allow platform, which has been proven to be ineffective in many cases as malware is evolving on a daily, almost hourly basis. A Default Deny Platform, however, provides total protection against zero-day threats.
