- Southern Water avoids questions about the payment of ransomware
- February 2024 — attack so customer data stolen in apparent attack
- It is left unclear whether the payment was made or not
Southern water has avoided confirming or denying claims that it paid a demand for ransomware for hackers after a larger cyberattack.
News broke that the company suffered a ransomware attack back in February 2024, which reportedly saw it losing a lot of data to attackers, data that ended up wasting on the dark web of a notorious ransomware operator known as Black Basta.
However, some were leaking about 200,000 messages that were exchanged between members of Black Basta, causing the security company Hudsonrock to create a blackbastagpt tool to help silk through the data more easily.
Payment and other hallucinations
Journalists from Registered Have now used the tool, in combination with raw chat data, to try to find out if the southern water paid ransom or not.
Apparently the group demanded $ 3.5 million, which was too high for the water company, which allegedly asked to reduce the requested price to $ 750,000.
While the chat logs do not clearly indicate whether the conditions were agreed, a member said at one point allegedly “these have already paid, are you remembering?”
However Registered Notes GPT hallucinates a lot and that the information should be taken with a grain of salt. When it reached the southern water directly, it did not receive a clear answer in which a spokesman said: “As soon as we became aware of over a year ago by an illegal intrusion affecting our IT systems (not affecting our operations or services to customers), we informed all relevant bodies, including NCSC and they and our advisors worked closely with NCSC over the entire incident.”
Southern Water is a tool company that supplies drinking water and wastewater services to customers in southern England, including Kent, Sussex, Hampshire and Isle of Wight. It operates water treatment facilities and sewerage systems.
Black Basta was formed in 2022 and has since targeted at least 500 organizations, with remarkable victims includes Ascension Healthcare, Capita, ABB and American Dental Association.
