The LockBit ransomware group claimed responsibility in February 2023 for an attack on Aguas e Energia do Porto, the municipally owned utility that manages water supply, wastewater and rainwater drainage for Portugal's second largest city.
The utility announced the attack in a statement on 30 January 2023. The company said its security team limited the damage, and that public water supply and sanitation operations were not affected.
Customer facing services were disrupted. The utility said some customer services had suffered constraints and asked anyone who had submitted an information request, service request or complaint in the preceding 72 hours to contact it again, noting that its capacity to respond was limited.
LockBit added the utility to its dark web leak site on 18 February and set a deadline of 7 March 2023, threatening to publish stolen information if it was not paid. The group had not posted sample files as proof of the theft at the time of reporting, and the utility did not confirm what, if anything, had been taken. Security Affairs also reported claims that the credentials used in the attack may have originated with an IT services supplier, Divultec.
Portugal's National Cybersecurity Centre and the Judiciary Police were investigating. The utility serves roughly 500,000 people through a drinking water distribution network of about 818 kilometres.