FBI investigates cyberattack on Micro-Comm equipment manufacturer in Kansas

The U.S. Federal Bureau of Investigation is investigating a cyberattack on Micro-Comm, a company based in Olathe, Kansas, that manufactures programmable logic controllers for critical infrastructure. As Channel NewsAsia reports, citing Reuters, the FBI confirmed that it is in contact with the company and coordinating with other law enforcement agencies.

Statement by the Barracuda group

The Barracuda group, which uses ransomware, claimed responsibility for the incident. It says it operates for profit and has no state backing. On August 6, the group published what it described as nearly 850,000 company files with a total volume of approximately 644 gigabytes.

Micro-Comm manufactures programmable logic controllers — computer devices used to control equipment in critical infrastructure networks. In the case of the company’s products, such controllers are used, among other places, at wastewater treatment facilities. Micro-Comm co-owner Jim Cote said the company discovered the breach on July 31.

What data may have been disclosed

According to Cote, the files published by the hackers did not contain passwords or user credentials, as these are stored by customers. He also said they did not contain data on Micro-Comm’s capabilities to remotely access its own devices.

More current news is available on the UA.News Telegram channel Telegram.

In a customer notice dated August 8, the company reported a limited malware attack and said that any confidential information in the files was encrypted. According to Cote, the FBI told the company that the data leak was an opportunistic attack not aimed directly at Micro-Comm. The company advised customers to change their passwords as a precaution.

Background of attacks on water infrastructure

The incident occurred during a series of attacks in late July on programmable logic controllers in Minnesota and at least six other U.S. states. Cybersecurity experts believe those attacks may have been part of an ongoing campaign linked to Iran. At the same time, Micro-Comm said its case was not connected to the breaches of water systems reported by the media.

According to Censys, about 200 Micro-Comm SCADAview CSX systems used in the United States are accessible from the internet. SentinelOne researcher Tom Hegel noted that the publication of the files does not mean that the operation of water systems has been compromised, but the information may be useful to attackers in the future.