Vice Society claims cyberattack on Puerto Rico water utility PRASA

The Puerto Rico Aqueduct and Sewer Authority, the government owned utility known as PRASA that supplies drinking water and sewerage services across the island, disclosed a cyberattack on 19 March 2023.

The authority said attackers reached systems holding customer and employee information. It activated its incident response procedures, began notifying affected people by letter, and advised customers to change their passwords across its platforms. PRASA stressed that the operational systems running its water and wastewater infrastructure were segmented from the affected environment and that service to customers was not interrupted.

The Vice Society ransomware group added PRASA to its dark web leak site the following week and posted sample documents that included passports and driver's licences. PRASA did not name the group, saying only that the criminal organisation behind the attack had already been identified at a national level, and declined to comment further while the investigation was under way.

The FBI and the Cybersecurity and Infrastructure Security Agency opened an investigation into how the attackers got in and how much data they took. Neither PRASA nor the federal agencies published a figure for the number of customers and employees affected as of late March 2023.