Veolia North America, the US arm of the French water and waste services group, said a ransomware attack had affected software applications and systems within part of its Municipal Water division. In a public notice, the company said the incident had occurred the previous week and that its IT and security incident response teams were mobilized as soon as it was detected.
As a containment measure, Veolia took targeted back-end systems and servers offline. That decision interrupted online bill payment for customers of the division, which serves more than 200 communities across the United States. The company said the affected systems were subsequently restored and that customers would not be penalized for late payments or charged interest for the period the systems were unavailable.
Veolia said there was no evidence the attack had disrupted water or wastewater treatment operations. It added that a limited number of individuals may have had personal information compromised and that those people would be contacted directly. The company did not say whether they were customers, employees or business partners.
A third-party forensics firm was engaged to investigate, and Veolia said it was cooperating with law enforcement. No group publicly claimed the attack, and The Record reported that Veolia did not respond to questions about who was responsible.