Swedish state owned power grid operator Svenska kraftnät confirmed on Monday that it suffered a cyberattack resulting in a data breach. The incident, discovered on Saturday, affected an isolated, external file transfer solution, but crucially, did not impact the power grid itself.
The public utility's Chief Information Security Officer, Cem Göcören, stated that the country’s electricity supply was not affected by the breach.
Everest Ransomware Connection
Since learning of the attack, Svenska kraftnät has been investigating its scope and impact and has reported the incident to authorities. Göcören declined to share additional information about the attack or the responsible threat actor, citing the ongoing investigation, but stressed that no critical systems were impacted.
The data breach was swiftly attributed to the Everest ransomware group. The group added Svenska kraftnät to its dark web leak site, essentially confirming its responsibility for the attack. Everest claims to have stolen approximately 280 gigabytes of data from the power grid operator. The threat actor is demanding a ransom, threatening to leak the stolen data online if Svenska kraftnät does not comply.
The company has not yet clarified the type of data Everest exfiltrated, but promised to provide additional details as the investigation progresses.
Everest has been active since December 2020, focusing recently on data exfiltration and pure extortion tactics. Earlier this year, the group claimed responsibility for the Collins Aerospace hack, an incident that disrupted major European airports. Svenska kraftnät manages 17,500 km of power lines and is a major player in the pan European power market.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
