Scottish Agency Still Recovering from 2020 Ransomware Attack
A ransomware attack on a Scottish regulator in 2020 continues to significantly impact operations, with the true cost of the incident still unknown, an audit has found.
The double extortion attack hit the Scottish Environment Protection Agency (SEPA) on Christmas Eve 2020, forcing IT services offline.
According to a new report from Audit Scotland, the initial attack vector appears to have been a phishing email, although it’s still not 100% clear.
Despite following best practice backup guidelines, with one copy stored offline, the “sophisticated nature of the attack” meant online copies were quickly targeted, and there was no way of accessing historical records quickly, the spending watchdog claimed.
As a result, the “majority” of SEPA’s data was encrypted, stolen or lost.
Despite claiming the agency had a “high” level of cyber-maturity, independent reviews since the attack have also made 44 recommendations for enhancing the agency’s cyber-readiness and resilience.
According to Audit Scotland, it will be particularly alarming to Scottish taxpayers that more than a year on from the attack, the agency is still reinstating some of its systems.
The auditor took the rare step of issuing a “disclaimer of opinion” on SEPA’s annual accounts for 2020/21, claiming it couldn’t access enough evidence to substantiate £42m of income from contracts.
The agency still doesn’t know the total financial impact of the cyber-attack, although it has already been forced to write off over £2m in bad debts because of records lost to the incident.
“Based on management forecasts during the year, the Scottish Government gave SEPA authority to overspend by £2.5m to cover the impact of Covid19 and the cyber-attack if required,” the report claimed.
“SEPA recognizes that the cyber-attack has increased the medium to longer-term financial pressures on the organization. Its financial strategy 2020-24 had already identified potential variability in future income and expenditure streams of up to £17.9m as a worst-case scenario.”
More Stories
Alabama Hacker Admits Role in SEC X Account Breach
An Alabama man has admitted hacking into the US Security and Exchange Commission’s X account using SIM swap fraud to...
New Chinese Hacking Campaign Targets Manufacturing Firms to Steal IP
Chinese hackers are infiltrating the networks of suppliers of “sensitive” manufacturers, according to a Check Point report to be published...
DDoS Attack Volume and Magnitude Continues to Soar
Gcore reported a 56% year-over-year rise in DDoS attacks in H2 2024, highlighting a steep long-term growth tend for the...
Ransomware Gangs Increasingly Prioritize Speed and Volume in Attacks
Ransomware groups are adopting agile techniques in a quantity-over-quality approach, according to a new report from Huntress Read More
8Base Ransomware Site Seized, Phobos Suspects Arrested in Thailand
Four Europeans were arrested in Phuket, believed to be members of the Phobos ransomware group Read More
Trusted Encryption Environments
Really good—and detailed—survey of Trusted Encryption Environments (TEEs.) Read More