Ransomware Attack hits Romania’s National Water Authority

A ransomware attack has compromised more than 1,000 IT systems at Romania’s national water authority, underscoring the growing cyber risk to essential public services.

The breach impacted IT systems across nearly all regional water basin administrations. Despite the scale, officials emphasized that physical water operations remained unaffected.

“Operational Technologies (OT) were not affected,” said Romania’s National Directorate of Cyber Security.

Systems Affected Across Romania’s Water Authority

Romania’s National Management Apele Române reported that attackers compromised a significant number of IT systems. Specifically, the attack affected:

• Website: The official website of Apele Române was taken offline as a direct result of the attack.
• Email Servers: Email communication was disrupted, hindering internal adn external correspondence.
• Data Servers: Access to various data servers was restricted, possibly impacting data availability and integrity.
• Internal Applications: Several internal applications used for administrative and operational tasks were rendered inaccessible.

What is Ransomware?

Ransomware is a type of malicious software (malware) designed to encrypt a victim’s files, rendering them unusable. Attackers then demand a ransom payment, typically in cryptocurrency, in exchange for a decryption key. Ransomware attacks have become increasingly sophisticated and targeted, with critical infrastructure being a prime target. The Cybersecurity and Infrastructure Security Agency (CISA) provides resources and guidance on preventing and responding to ransomware attacks.

Impact and Response

While the attack disrupted IT systems, Romanian authorities were fast to emphasize that the core function of providing water services remained operational.This is largely due to the fact that the attack targeted IT systems, not the Operational Technology (OT) that directly controls water distribution. OT systems are frequently enough isolated from general IT networks to prevent this type of disruption.

The National Directorate of Cyber Security is currently investigating the attack,working to identify the attackers and restore affected systems. They are collaborating with international partners to share data and coordinate a response. the Record reports that the ransomware used in the attack is believed to be the hades ransomware.

Preventative Measures for Critical Infrastructure

This incident highlights the importance of robust cybersecurity measures for critical infrastructure. Key preventative measures include:

• Network Segmentation: Isolating critical OT systems from general IT networks.
• Regular Backups: Maintaining up-to-date backups of all critical data.
• Multi-Factor Authentication (MFA): implementing MFA for all remote access and privileged accounts.
• Vulnerability Management: Regularly scanning for and patching vulnerabilities in systems and software.
• Incident Response Plan: Developing and testing a comprehensive incident response plan.

Key Takeaways

• A major ransomware attack impacted Romania’s national water authority, affecting over 1,000 IT systems.
• Physical water operations were not disrupted due to the attack targeting IT systems,not Operational Technology.
• The attack underscores the growing cyber threat to critical infrastructure worldwide.
• Robust cybersecurity measures, including network segmentation, regular backups, and MFA, are crucial for protecting critical infrastructure.