LockBit ransomware group targets Portuguese water utility company, demands a ransom

The LockBit ransomware group has claimed responsibility for a cyber attack on Portugal’s water utility company Águas e Energia do Porto that disrupted certain customer services.

Águas e Energia do Porto is a Portuguese municipal water utility company responsible for full water cycle management, including drinking water supply, domestic wastewater management, rainwater drainage, and the maintenance of streams and beaches.

The company said in a statement on February 8 that it was able to limit the attack and activated security protocols immediately. “It should be noted right away that all essential public water supply and sanitation services are fully guaranteed,” it said.

“Due to the incident, some customer services suffered constraints. Since the company’s response capacity is limited, it is suggested that customers contact us through alternative means to obtain indications on the best way to handle their requests.”

The notorious LockBit ransomware gang, known for targeting critical infrastructure companies, has claimed responsibility for the cyber attack on Águas e Energia do Porto. According to cybersecurity expert Dominic Alvieri, the gang listed the water utility company on its data leak site on February 18 and has given the company a deadline of March 7 to pay a ransom and recover stolen data.

The water utility company has reported the ransomware attack to the National Cybersecurity Center and the Judiciary Police and is working with both agencies to investigate the breach.

“Águas e Energia do Porto is making every effort to restore normal operating conditions as soon as possible, and is working closely with the different competent authorities, namely the National Cybersecurity Center and the Judiciary Police,” the company added.

The ransomware attack is the second such incident involving a Portuguese company in as many months. In January, the LockBit ransomware group also targeted the Port of Lisbon Administration (APL), forcing authorities to take its official website offline.

While APL authorities did not specify the nature of the cyber attack or who was responsible for the same, the ransomware gang listed APL in its list of high-profile victims. The gang claimed it stole financial reports, audit reports, budgets, contracts, cargo information, ship logs, crew details, customers’ personally identifiable information, port documentation, and email correspondence.

The gang gave the Port of Lisbon a deadline of January 18 to pay a ransom of around $1.5 million in exchange for not publishing the stolen data.