U.S. Energy Firm Fined $2.7 Million Over Data Security Incident

An energy firm in the United States has been fined $2.7 million over a data security incident that resulted in the exposure of critical cyber assets.

The North American Electric Reliability Corporation (NERC) revealed last month that an unnamed power company had agreed to pay the massive penalty and take action to avoid future leaks.

The affected entity has not been named, but the penalty notice published by NERC provides some details about the incident and clarifies that while the energy firm agreed to pay the fine, it neither admitted nor denied violating Critical Infrastructure Protection (CIP) NERC reliability standards.

The incident, which has been assigned a risk rating of “serious,” involved a third-party contractor that improperly copied data from the energy firm to its own network. Despite receiving training, the contractor failed to comply with the company’s information protection program.

A security researcher discovered that the contractor allowed anyone to access the data without a username or password. According to NERC, more than 30,000 records were exposed, including critical cyber assets (CCAs), IP addresses, and server host names. The information was available online for 70 days.

E&E News, which first reported on the fine, pointed out that one suspect is Pacific Gas and Electric (PG&E), a California-based natural gas and electric utility that exposed a lot of information back in 2016.

Researcher Chris Vickery, who at the time worked for MacKeeper, discovered a misconfigured database containing information on 47,000 computers, servers, virtual machines and other devices. PG&E initially said the data was fake, but later admitted that a vendor had exposed its records.

Many of the details mentioned in the NERC document match the PG&E incident. Vickery told E&E that PG&E had him delete the data and sign an affidavit, which is exactly what the NERC document describes.

SecurityWeek has reached out to PG&E for comment and will update this article if the company responds.

Following the significant cyberattacks that hit Ukraine a few years ago, the energy sector in the United States has been taking steps to prevent such incidents. The U.S. Energy Department announced recently its intention to invest over $20 million in cybersecurity projects, and the launch of the Office of Cybersecurity, Energy Security, and Emergency Response (CESER).

The Federal Energy Regulatory Commission (FERC) also recently proposed new cyber security management controls designed to enhance the reliability and resilience of the nation’s bulk electric system.

A bill introduced last year by senators, the “Securing Energy Infrastructure Act,” aims to establish a pilot program to identify vulnerabilities in the energy sector. The bill, which according to Nextgov recently passed the Senate Committee on Energy and Natural Resources, focuses on the development and deployment of protections for industrial control systems (ICS), particularly through analog and non-digital control systems, and physical controls.