U.S. utilities reported three cybersecurity incidents to the Electricity Information Sharing and Analysis Center (E-ISAC) in 2024, highlighting “the continued need for vigilance” even though none of the events affected grid reliability, NERC said in a filing to FERC on March 21 (RM18-2).
Electric utilities are required by reliability standard CIP-008-6 (Cybersecurity — incident reporting and response planning), which took effect in January 2021, to report qualifying cybersecurity incidents to the E-ISAC. (See FERC OKs Cyber Reporting Rule.) According to NERC’s technical rationale for the standard, reportable incidents are those that compromise or disrupt:
-
- a cyber system that performs one or more reliability tasks of a functional entity;
- an electronic security perimeter of a high- or medium-impact grid cyber system; or
- an electronic access control or monitoring system of a high-impact grid cyber system.
- FERC Order 848 directs NERC to submit an “annual anonymized, public summary of the reports” to the commission. Reports must include the intended effect of the cyber incident, the attack vector of the incident and the level of intrusion the attacker achieved or attempted.
NERC’s cyber incident report for 2024 did not identify the reporting entities, but it did note that one report was in the territory of the Northeast Power Coordinating Council, one in ReliabilityFirst and one in WECC. The ERO did not specify which reports (identified as A, B, and C) originated in which territory.
Report A detailed an incident in which the responsible entity received 20 alerts from its security information and event monitoring system that someone had tried to log in to a medium-impact grid cyber system. The login attempts used an intermediate system and appeared to originate from IP addresses in Wyoming and Florida. The entity believed both addresses were from the same attacker because they used the same username for the login attempts.
In report B, the entity indicated it had received multiple failed virtual private network authentication attempts across two apparent attempts to compromise. The first attempt involved multiple IP addresses from a foreign country, resulting in users being locked out. The next try occurred about a month later, with a “large volume of failed authentication attempts” targeting the same VPN interface. All attempts were “linked by the same internet service provider,” NERC said.
The final report covered an attempted scan of an entity’s Supervisory Control and Data Acquisition (SCADA) network by a foreign IP address. NERC said company logs showed the “attacker only made initial connections to the network and then was blocked by the entity’s firewall.”
According to NERC’s report, the biggest effect to utility operations from any of the incidents was the loss of access by an unspecified number of users during the first intrusion attempt identified in report B, and about 20 user accounts in the second attempt. The incident “strained operational efficiency and the IT service desk handling the … lockouts,” NERC said, but the attackers failed to gain access to any grid cyber systems.
Reports A and C did not identify any disruption to operations. NERC said the controls of both entities “were effective in identifying and mitigating the [attempts] to compromise.”
The ERO noted that none of the three incidents rises to the level of a reportable cyber incident because the attackers did not compromise or disrupt any grid cyber systems. However, two of the attacks showed “an increased level of sophistication” compared to attempted intrusions in previous years through the use of multiple IP addresses.
The E-ISAC has received 16 reports on cybersecurity incidents since CIP-008-6 went into effect, none of which qualified as reportable. Half of these were received in 2022; three each arrived in 2023 and 2024, and two came in 2021. Malware such as Trojan horses and ransomware was the most common attack vector over the past four years, accounting for 38% of the reported incidents. The next most common was attacks on third parties that support grid operations.