Bad weekend at the Ile-de-France public sanitation service, Siaap. This public company responsible for transporting and cleaning up the waters of Île-de-France, i.e. 2.5 million cubic meters per day, has just announced that it has been the victim of a “major cyberattack” since last week.
As specified in Le Monde IT, the hacking would only concern the management IT, professional messaging or human resources of this company of 1,800 agents. Without touching, at this stage, the tools allowing the activity of this structure to be directly managed.
Securing industrial IT
However, it is this industrial computing which is the subject of all attention. Because a diversion of these infrastructures would be a catastrophe. “Over the past forty-eight hours, the action of the specialized teams has mainly focused on the objective of maximum security of industrial IT making it possible to ensure the management of the activity of networks and factories”, specifies the Siaap.
Assisted by Anssi, the public company’s experts also worked to prevent the spread of attackers, with unspecified affiliation or modus operandi. As The Record notes, no group of hackers or cybercriminals has yet taken credit for this attack against a critical service, likely to be an effective lever in an extortion attempt.
Several water utilities across the globe have recently been victims of ransomware attacks. Like the city of Porto, targeted by the LockBit cybercriminal franchise, South Staffordshire Water, targeted by Cl0p, or even Puerto Rico, affected by Vice Society.
Crisis unit
To deal with this crisis, a situation of “imperative emergency”, the Siaap issued an order last Thursday allowing it to award contracts without competitive bidding. “The crisis unit remains mobilized to manage the aftermath of this attack and support the continuity of the work of all of its agents from this week in a context and working environment largely degraded by the current situation,” adds the organization. .
A complaint was finally filed with a police force, while the guardian of personal data, the CNIL, was notified, as required by regulations.