Data breaches wreck grid security from smart grids.

Data has become a critical component of the Utilities Sector. But as data becomes more valuable to utilities, Data Security is now at the top of the agenda. And as grids become smarter, energy models become more distributed and flexibility becomes a day-to-day part of balancing the grid, the role of data is only going to become more important.

A data breach can be costly, both financially and reputationally and it has a knock-on effect on trust both with customers and energy sector partners.

Unfortunately, it is not only energy sector professionals that understand the value of energy data. Cybercriminals have noticed this too. This has made utilities prime targets for attacks. Keeping data secure, whether it’s being stored in a Data Lake or shared with energy sector partners, must be a priority.

Visibility of energy data is key. The ability to map and track data helps utilities to keep their data secure and enables them to uncover any potential breaches as quickly as possible.

A modern integrated Platform as a Service (iPaaS) solution that can monitor and handle data securely in a distributed architecture makes an enormous difference.

A Utilities Sector Data Breach: What are the Costs?

In IBM’s annual cost of a data breach report in 2021 the average cost of a data breach from those surveyed was $4.24 m. The chart below shows how these costs are incurred.

In today’s digital and connected environment the chances are high that a breach will occur. As utilities consider information and cyber security it is important for them to not only think about the cost of a data breach, but also what will be permanently lost because of that breach. For utilities this means the loss of man hours, the loss of information, intellectual property, and more.

In the utilities sector, other factors must also be considered:

1. It’s a highly regulated industry Breaches in more regulated industries are usually more costly. In the energy sector, the cost of a breach is slightly higher than average at $4.65m

2. Additional costs of a cyberattack Costs associated with ransomware or cyberattacks soon escalate. Colonial Pipeline paid a reported $4.4m to its attackers (although some of this was later recovered)

3. The length of time to discover a breach The longer it takes to identify and contain a breach, the costlier it becomes. It took an average of 287 days to identify and contain a breach in 2021.

4. Fines and legal costs Data breaches may incur fines from regulatory bodies such as those that come under the EU’s General Data Protection Regulations (GDPR). In the US there is move towards Data Privacy class action cases. US investment bank, Morgan Stanley recently agreed to pay $60 million to settle a class-action lawsuit following incidents that left customer data exposed.

5. Reputational Damage It’s hard to convert reputational damage into an exact monetary value, but its impact can be severe. In the utilities sector it’s not always easy for customers to take their business elsewhere if their personal information has been stolen or breached. However, now more than ever before, consumers are an important part of the energy system. Their data and co-operation are vital in the effective management of flexibility markets or time-of-use tariffs. A knock in consumer confidence could have a devastating impact on these services.

The Relationship between Data Breaches and Cyberattacks

Cyberattacks are not the only cause of data breaches. Human error (ever sent an email to the wrong person?) and physical breaches such as theft also play a part. But recent statistics from the US’ Identity Theft Resource Center show that human error and physical breaches have reduced over the last two years. Breaches caused by cyberattacks are by far the most common reason for a data breach and these have been increasing since 2019.

Cybercriminals understand that data has become a valuable commodity, critical to businesses operations. In one new tactic, ransomware gangs are using ‘double extortion’ where ransomware is combined with data theft. The gang not only encrypts files (as with ‘traditional’ ransomware) but threatens to publish or sell sensitive information unless the ransom is paid. Paying a ransom is no guarantee of Data Security – the information may be published anyway.

Data is going to be breached. Accidents happen and hackers are persistent. In this environment, preparation is key. Visibility of data enables utilities to better handle the situation and recover quickly.

The Utilities Sector: A Vulnerable Target

2021 was the year that cyberattacks became headline news. A series of incidents affecting large enterprises, including those in the utilities sector, were reported one after the other. But it was the ransomware attack on Colonial Pipeline that captured the attention of the media, as gas stations ran dry and panic buying set in. The event highlighted the impact an attack on critical infrastructure could deliver to people’s everyday lives.

Yet it was by no means the only attack on utilities in 2021. The utilities sector was the second most targeted industry by cybercriminals (after financial institutions). A series of attacks targeting US water treatment plants in 2021 illustrates just how vulnerable utilities are. An attack on a utility and holding utility data hostage gives cybercriminals enormous leverage.

Data Breaches and Digital Transformation

The future energy landscape is digitalized. Smart grids, smart meters, grid-edge innovation, and distributed energy resources are all vital ingredients of this fast-developing model.

But they also increase the number of potential points for a data breach to occur. Every IoT device and sensor, every solar installation, windfarm or microgrid is a potential vulnerability for cybercriminals to target.

As the shift to the distributed energy system continues, data sharing between all participants in the energy ecosystem is critical to a balanced grid and the smooth running of the system. In these circumstances, data must be secure whether it’s in use, in rest or in motion. Proper encryption of data in motion, a ‘Zero-Trust’ approach to data in use and constant monitoring of data at rest are key.