Hackers targeted Sepa for second time during recovery bid – report

Cyber-criminals who attacked the Scottish Environment Protection Agency (Sepa) tried to sabotage recovery operations with a second attack, according to a new report.

Around 1.2GB of data, amounting to at least 4000 files, was stolen in the ransomware attack on Christmas Eve last year.

An investigation by Police Scotland concluded it likely that an international serious organised crime group was responsible for the extortion attempt.

The environmental regulator did not respond to the ransom request.

The attack “displayed significant stealth and malicious sophistication”, a report by the Scottish Business Resilience Centre (SBRC) found.

SBRC noted that back-ups were taken in line with best practice in that there were three copies of the data, kept in two separate locations, with one copy stored offline; however the design of the network meant that both sites were affected.

The report said: “This attack displayed significant stealth and malicious sophistication with a secondary and deliberate attempt to compromise Sepa systems as the team endeavoured to recover and restore back-ups.”

Sepa commissioned independent audits from Police Scotland, SBRC and business advisory group Azets following the attack.

The Azets review found that Sepa’s response following the triggering of the ransomware on December 24 2020 was “effective”.

However it also noted that emergency management and incident management procedures were not stored offline and offsite.

This meant that procedures became inaccessible when system access was lost, and staff had to rely on their knowledge and experience to carry out emergency management and incident management steps.

Sepa chief executive Terry A’Hearn said: “Ten months ago, on Christmas Eve, Sepa was the victim of a hideous, internationally orchestrated crime which impacted our organisation, our staff, our public and private partners and the communities who rely on our services.

“The audits make it clear we were well protected but that no cyber security regime can be 100% secure. A number of learnings have been identified that will help Sepa further improve its cyber security. All have been accepted.”

He added: “The majority of organisations hit by cyber attacks around the world do not publicise much about the attack, and that is their right. We know we have taken an unusual approach, but we are convinced it is the right thing for us to do.

“We are publishing as much as we can of the reviews so that as many organisations as possible can use our experience to better protect themselves from this growing scourge of cybercrime and have committed to supporting Police Scotland and Scottish Business Resilience Centre in their work on highlighting the support available to organisations to be cyber-ready, resilient, and responsive.”

The SBRC report determined Sepa’s cyber maturity assessment as “high” and said that sophisticated defence and detection mechanisms were implemented and operating correctly prior to the incident.

Detective Inspector Michael McCullagh, Cybercrime Investigations, Police Scotland, said: “Police Scotland has been consistently clear that Sepa was not and is not a poorly protected organisation. The organisation had a strong culture of resilience, governance, incident and emergency management and worked effectively with Police Scotland and others.

“Recent attacks against Sepa, the Irish Health Service and wider public, private and third sector organisations are a reminder of growing threat of international cyber-crime and that no system can be 100% secure.

“They’re also a reminder of the growing importance of organisations being ready, resilient, and responsive.”