A network intrusion at Colorado's Sangre de Cristo Electric Association disrupted bill payments and telephone services after the electric cooperative shut down its IT servers to contain suspicious activity.
The Buena Vista-based cooperative detected suspicious activity in September and isolated affected systems while cybersecurity specialists investigated. Chief Executive Officer Jon Beyer told The Chaffee County Times that an unauthorized organization accessed a server containing internal files.
“Our monitoring systems recently alerted staff to suspicious activity in SDCEA’s information technology network,” the cooperative said in an Oct. 2 notice.
The intrusion temporarily prevented members from paying electricity bills and contacting the cooperative by telephone. Both services have since been restored, although the duration of the interruption remains unclear.
“At no time was your electric service or the electric grid affected,” the cooperative said.
The INC Ransom extortion group has claimed responsibility for the intrusion, alleging that it stole customer information, financial records and technical documentation concerning the cooperative's electrical infrastructure. Its disclosure includes purported samples of stolen documents, including identification records, technical drawings and photographs of electrical equipment.
The group also claims to possess credentials, API keys and security configurations associated with systems used to monitor and control electricity distribution. The cooperative has not confirmed those allegations.
In its Oct. 2 disclosure, INC Ransom claimed that negotiations with the cooperative had ended and threatened further disruption, saying it would “take further disruptive actions.” The group attributed the breakdown in discussions to a decision by Beyer, an account the cooperative has not publicly corroborated.
Beyer told The Chaffee County Times that the cooperative was still determining what information the intruders obtained. He said member financial and payment information was not stored on the compromised local network. In an Oct. 7 notice, the cooperative said it had no evidence that sensitive personal or financial information had been misused.
Chip in once
If this reporting helped you, a one-time tip helps cover hosting, tools and future investigations.
Support us monthly
A small monthly pledge keeps independent coverage and our reader tools online for everyone.
Sangre de Cristo Electric Association is a member-owned electric cooperative serving portions of Chaffee, Fremont, Custer, Lake and Saguache counties in central Colorado.
The incident follows a network disruption in Big Spring, Texas that disabled electronic water-bill payments and prompted the city to waive late fees. Cybersecurity specialists were investigating the disruption, although officials had not confirmed a cyberattack. Neither incident was reported to have interrupted the underlying utility service.
Sangre de Cristo Electric Association said it strengthened its security following the intrusion. Its investigation into what information attackers accessed remains unresolved.
