News

The MAINE Monitor: In a first for Maine, ransomware hackers hit two public wastewater plants

Experts worry as cyber criminals target smaller utilities that play crucial roles.

By Kate Cough | August 15, 2021

Pace of attacks increasing ‘dramatically’

Attacks in Maine have increased dramatically in all sectors in the past year, said Scott Fossett, president of A Partner in Technology (API), a Gardiner-based company.

“The pace is picking up, definitely, over the last nine to 12 months,” said Fossett. “I have been in this industry over 20 years, and it was few and far between that this was happening to Maine businesses. Now we’re seeing it could be any business sector in Maine.”

Hackers also are targeting smaller and smaller organizations, said Derek Hussey, API’s chief technology officer.

“Two years ago we saw very little in Maine. But now, especially in the past nine months, we’re seeing a lot more. They’re targeting organizations that are only 10 people or less and adjusting that ransom accordingly.”

News that companies are paying ransoms encourages hackers to keep trying. “They’re making money at this,” Fossett said.

In 2018, the average ransomware payment nationwide was roughly $7,000, according to the security firm Coveware. In the second quarter of 2021, that figure had jumped to around $137,000. Although attacks such a recent one in Florida on a water system, in which the level of lye in the water was briefly adjusted, get a lot of attention, that’s not what most hackers are seeking.

“Their end goal is to earn money,” said Hussey. “They seem very good at being able to determine what size the business is and appropriately adjusting that number in their ransomware letter.”

In Maine, he’s seen hackers ask for as little as $1,200. “They’re going to look at a very small ransom, in hopes that the business can afford it, in hopes that they’re going to pay it.” 

Having backups may protect against data loss but doesn’t necessarily protect against ransom payments because hackers may threaten to publicly release data if a company or municipality doesn’t pay. 

Fossett declined to disclose what percentage of the company’s clients have paid a ransom to recover data or unlock systems. “As professionals in this business, we never want to see a client pay ransom. That’s our goal.”