Spanish water utility Aigües de Mataró confirms a major customer data breach

Spanish water supplier Aigües de Mataró said it suffered a significant data security incident that compromised the sensitive personal information of its subscribers.

 

Headquartered in Barcelona, Spain, Aigües de Mataró is responsible for both drinking water and sewage systems and caters to around 130,000 people in the city of Mataró.

 

In a data security incident notice published on April 23, the water supplier said that on April 21, it was a victim of a significant ransomware attack where unauthorised threat actors infiltrated its internal network and encrypted certain critical systems.

 

Aigües de Mataró immediately launched an investigation, with assistance from external cyber security experts, to determine the scope of the incident. It also took steps to mitigate the impact of the incident, activated its contingency plan and notified relevant law enforcement authorities about the same.

 

“Work is being done jointly with the Catalan Cybersecurity Agency to restore all services. The facts have been notified to the Catalan Data Protection Authority and the corresponding complaint has been filed with the Mossos d’Esquadra,” Aigües de Mataró said.

 

The investigation revealed that the sensitive personal information of its subscribers was compromised during the incident. The affected data included names, National Identity Documents (DNI), dates of birth, signatures, postal addresses, email addresses, telephone numbers, bank account information, and more.

 

Aigües de Mataró, has, however, clarified that bank payment card details were not compromised as a result of the cyber security incident.

 

“As a result of this cyberattack, subscribers may suffer inconveniences related to the inability to access certain services, such as access and procedures in the virtual office, the Comunicaigües alert service, possible delays in billing and in the processing of administrative procedures.

 

“This incident does not affect the water supply service or its quality. It has not impacted the management of the sewerage system or the TubVerd service,” the water supplier added.

 

At the time of publishing, no known hacker group claimed responsibility for the cyber attack on Aigües de Mataró. The company also did not share details on who was behind the attack, how much data was compromised, or whether it has received a ransom demand.