{
	"id": "a78b00f4-2d26-419e-a01e-1e00c1d530fd",
	"created_at": "2026-04-06T00:15:10.888855Z",
	"updated_at": "2026-04-10T03:26:47.119935Z",
	"deleted_at": null,
	"sha1_hash": "d3ca78a24c642b9c6213c0b7cdb139f27e859037",
	"title": "LockBit gang takes credit for attack on water utility in Portugal",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 113218,
	"plain_text": "LockBit gang takes credit for attack on water utility in Portugal\r\nBy Jonathan Greig\r\nPublished: 2023-03-07 · Archived: 2026-04-05 14:17:58 UTC\r\nThe LockBit ransomware group has taken credit for an attack on the water utility of Porto, Portugal's second-largest city.\r\nÁguas e Energia do Porto said on February 8 it had been hit with a cyberattack, with its security team able to limit\r\nthe damage. Public water supply and sanitation were not affected by the attack. \r\nThe LockBit group added the company to its leak site on February 18, according to cybersecurity expert Dominic\r\nAlvieri. \r\nLockBit gave the utility until March 7 to pay a ransom, threatening to publish stolen information from Águas e\r\nEnergia do Porto systems if the deadline passed without payment.\r\nThe utility is owned by the city and is one of the largest Portuguese water supply and wastewater sanitation\r\ncompanies, serving approximately half a million people.\r\n“Due to the incident, some customer services suffered constraints,\" the utility said, urging people to find other\r\nways to get information, \"since the company's response capacity is limited.\" \r\nThe company was still able to process customer requests at in-person service desks, and it urged people to get\r\nvirtual service tickets that could be obtained instead of standing in line. \r\nhttps://therecord.media/porto-portugal-water-utility-cyberattack-lockbit\r\nPage 1 of 4\n\nhttps://therecord.media/porto-portugal-water-utility-cyberattack-lockbit\r\nPage 2 of 4\n\nCredit: Dominic Alvieri\r\nÁguas e Energia do Porto said it contacted both the Portuguese National Cybersecurity Center and the Judiciary\r\nPolice for assistance with the situation. \r\nThe utility did not respond to requests for comment about an update on the situation. \r\nIn addition to managing the water supply and wastewater, the company drains Porto's rainwater, controls about 85\r\nkilometers of water lines, manages the city's waterfront, and more.\r\nLockBit back for more\r\nIn December 2022, LockBit breached and encrypted systems at Port of Lisbon, Portugal’s busiest port and one of\r\nthe most used across all of Europe.\r\nOver the last two years, the country has seen cyberattacks or ransomware incidents cripple one of their largest\r\ntelecommunications providers, their largest television channel, as well as several financial and insurance\r\ninstitutions.\r\nWater utilities are also frequent targets for ransomware gangs because of the personal customer information,\r\nfinancial data and residence information the companies typically hold.\r\nAn August ransomware attack on England's South Staffordshire Water may have enabled cybercriminals to steal\r\ncustomer bank details, the company said in December.\r\nU.S. law enforcement agencies said ransomware gangs hit five U.S. water and wastewater treatment facilities\r\nfrom 2019 to 2021 — and those figures did not include three other widely-reported cyberattacks on water utilities.\r\nhttps://therecord.media/porto-portugal-water-utility-cyberattack-lockbit\r\nPage 3 of 4\n\nJonathan Greig\r\nis a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since\r\n2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia.\r\nHe previously covered cybersecurity at ZDNet and TechRepublic.\r\nSource: https://therecord.media/porto-portugal-water-utility-cyberattack-lockbit\r\nhttps://therecord.media/porto-portugal-water-utility-cyberattack-lockbit\r\nPage 4 of 4",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://therecord.media/porto-portugal-water-utility-cyberattack-lockbit"
	],
	"report_names": [
		"porto-portugal-water-utility-cyberattack-lockbit"
	],
	"threat_actors": [
		{
			"id": "0fc739cf-0b82-48bf-9f7d-398a200b59b5",
			"created_at": "2022-10-25T16:07:23.797925Z",
			"updated_at": "2026-04-10T02:00:04.752608Z",
			"deleted_at": null,
			"main_name": "LockBit Gang",
			"aliases": [
				"Bitwise Spider",
				"Operation Cronos"
			],
			"source_name": "ETDA:LockBit Gang",
			"tools": [
				"3AM",
				"ABCD Ransomware",
				"CrackMapExec",
				"EmPyre",
				"EmpireProject",
				"LockBit",
				"LockBit Black",
				"Mimikatz",
				"PowerShell Empire",
				"PsExec",
				"Syrphid"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434510,
	"ts_updated_at": 1775791607,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/d3ca78a24c642b9c6213c0b7cdb139f27e859037.pdf",
		"text": "https://archive.orkl.eu/d3ca78a24c642b9c6213c0b7cdb139f27e859037.txt",
		"img": "https://archive.orkl.eu/d3ca78a24c642b9c6213c0b7cdb139f27e859037.jpg"
	}
}