Power Utility HSE Recovering From Cyberattack

HSE, Slovenia’s largest power utility, has been targetted by a serious cyberattack that officials have said has since been brought under control as functionalities of the IT system are being restored. The incident, which started late on 22 November and escalated in the night to 25 November, has not jeopardised production or supply of electricity.

“Key power station operation and trading systems are operational, the connection to the national grid operator has been restored and there are good prospects that a smooth operation of the entire communications and IT infrastructure will be restored without major negative consequences,” HSE said on 27 November.

The company denied media reports of a temporary outage in a high water level alarm system and a temporary inability to trade in electricity, one of the group’s key activities apart from electricity production.

“We would like to emphasise that HSE had the power stations of the HSE group under control at all times, and safety has also been ensured, with the high water alarm system also working without disruption,” HSE director general Tomaž Štokelj was quoted as saying.

“Electricity trading has not been interrupted and is ongoing, but as a precautionary measure we have slightly limited the execution of individual transactions,” he added.

The Cause of the Incident Not Clear Yet

Uroš Svete, director of the Government Information Security Office, confirmed that the attack involved a crypto-virus, a type of ransomware that locks files. The information gathered so far, including from HSE, suggests the attack was carried out from the outside. “From this point of view, it’s a pretty classic cyber incident,” Svete said.

“Based on what we’ve seen we can be optimistic that there will be no major consequences either in terms of system security or the impact on the company’s business performance,” HSE director general Štokelj.

HSE operates the Šoštanj thermal plant, which accounts for around a third of domestic electricity production, as well as chains of hydro plants on the Drava, the Sava and the Soča. The group accounts for roughly 60% of domestic electricity production.

The attack is considered one of the biggest such incidents in Slovenia’s history. Apart from IT and cyber security experts, the national intelligence agency SOVA and the Defence Ministry’s security and intelligence service are looking into the background of the incident.