Pierluigi Paganini March 11, 2020

The European Network of Transmission System Operators for Electricity (ENTSO-E) disclose a security breach this week.

The European Network of Transmission System Operators for Electricity (ENTSO-E) revealed this week that threat actors penetrated its network.

ENTSO-E, the European Network of Transmission System Operators, represents 43 electricity transmission system operators (TSOs) from 36 countries across Europe, thus extending beyond EU borders. ENTSO-E was established and given legal mandates by the EU’s Third Package for the Internal energy market in 2009, which aims at further liberalising the gas and electricity markets in the EU.

ENTSO-E works with TSO on the definition of Europe’s energy and climate strategy. According to the organization, the attack only impacted the office network and did not affect any operational TSO system.

“A risk assessment has been performed and contingency plans are now in place to reduce the risk and impact of any further attacks,” reads the statement published by the company. “Our TSO members have been informed and we continue to monitor and assess the situation.”

Some of the affected TSOs also published security advisories ([1], [2], [3]) about the security incident and explained that hackers did not breach their networks.

“The incident only affects file exchange policies between Fingrid and ENTSO-E. We have instructed our staff based on the information received from ENTSO-E and we have implemented technical preparedness measures accordingly.” reported Finland’s TSO, Fingrid.

The attack is worrisome because threat actors have targeted a centralized authority in the attempt to impact one of the European electrical grids.

Another element of concern is the timing of the attack, in this period the Coronavirus outbreak is having an important impact on organizations and their personnel. In many cases, employees ordinary working to defend the organizations are involved in smart-working with a significant impact on their productivity and efficiency. The overall process could suffer important changes advantaging the attackers.

“An attacker may access these organizations to harvest sensitive information about supported entities. This may facilitate information gathering and target development operations while avoiding any direct access to the victims.” reads a post published by security firm Dragos. “As a result, the attacker would effectively expose information from several organizations at the same time through a single intrusion.”

Pierluigi Paganini

(SecurityAffairs – hackin, ENTSO-E)

[adrotate banner=”5″]

[adrotate banner=”13″]