Ransomware attack disrupts Romania’s national water authority

Romania's National Directorate for Cyber Security reported a significant ransomware attack that compromised approximately 1,000 IT systems belonging to the nation’s water authority, Administrația Națională Apele Române, on Saturday, based on information published by The Cyber Express.

The attack impacted 10 of the country's 11 regional water basin administrations, including Oradea, Cluj, Iași, Siret, and Buzău. Threat actors exploited BitLocker, a legitimate Windows encryption mechanism, to maliciously lock files and demand a ransom within seven days. Critical systems like GIS application servers, database servers, workstations, and email servers were affected. However, operational technologies remained unaffected, ensuring that hydrotechnical structures continued to operate securely through dispatch centers using voice communications and manual oversight.

This incident highlights a vulnerability in Romania's critical infrastructure, as the water authority's IT systems were not protected by the national defense system. Procedures are now underway to integrate this infrastructure into national cyber protection systems. The attack also demonstrates an evolving ransomware tactic of weaponizing built-in security tools, prompting a review of cybersecurity measures for critical national infrastructure.

Source: The Cyber Express