Recent ransomware attacks have impacted two major water supply systems in the United States and the United Kingdom, with Boston-based Veolia North America and England's Southern Water falling victim to cyber threats. In both instances, attackers have reportedly seized employee or customer data and are demanding ransom payments. Fortunately, neither organization has reported prolonged service disruptions due to encrypted files or folders, and no ransom payments have been disclosed.

Veolia North America, serving approximately 550 communities, acknowledged a ransomware incident affecting its Municipal Water division. The attack prompted the temporary shutdown of some software applications and systems, causing delays in online bill payment systems for customers. The company assured that no operational technology, including industrial control systems, was compromised. Digital forensics investigators were promptly engaged to investigate the intrusion, and affected individuals will be directly notified about the stolen personal information.

Similarly, Southern Water in the UK confirmed a ransomware attack by the Black Basta group but asserted that no data encryption occurred, and critical operations remained intact. The utility, serving 2.5 million water customers and over 4.7 million wastewater customers, is still evaluating the extent of potential data theft. The Black Basta group claimed to have stolen 750 gigabytes of data, including corporate documents and users' personal information. Southern Water emphasized that customer relationships and financial systems remained unaffected, and services continued without disruption.

These incidents come amid a broader surge in ransomware attacks, as highlighted in a report by British consultancy NCC Group, revealing an 84% increase in known ransomware attacks in 2023 compared to the previous year. The U.S. Cybersecurity and Infrastructure Security Agency recently released an incident response guide for the water and wastewater sector, emphasizing the potential cascading impacts of a compromise in critical infrastructure sectors.

The White House has been urging various critical infrastructure sectors to enhance their cybersecurity posture, with a focus on reviewing and improving defenses. The attacks also underscore the ongoing challenges in ensuring the cybersecurity of essential services, prompting organizations to remain vigilant and proactive in safeguarding their systems.