Cyber Incident Victim: BeatStars
Date:
Mar 2018
Location:
India
Summary
A cyber attack targeted a Haryana power distribution utility, encrypting billing data for approximately 4,000 industrial consumers across multiple service areas. Attackers demanded a Bitcoin ransom to decrypt the data, but the organization restored operations using backups without paying, confirming no business disruption or financial loss occurred. The incident prompted an investigation under extortion and IT violation laws, with the utility accelerating plans to replace its legacy system with a more secure infrastructure.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On March 21, 2018, Uttar Haryana Bijli Vitran Nigam Limited (UHBVNL), a government-owned power distribution company serving northern Haryana, experienced a cyber attack targeting its Automatic Meter Reading System (AMR). Attackers encrypted billing data for approximately 4,000 industrial consumers using between 15KW and 20KW of electricity across nine operational circles: Panchkula, Ambala, Rohtak, Yamunanagar, Panipat, Kaithal, and Karnal. The compromised data included records of paid and unpaid bills. Hackers displayed an on-screen ransom demand for ₹1 crore (equivalent to ~$154,000 USD at the time) payable via Bitcoin cryptocurrency in exchange for the decryption key. UHBVNL personnel discovered the encryption during immediate system analysis conducted by internal IT staff and external cyber experts following the intrusion detection.
UHBVNL officials confirmed no operational disruption or financial loss occurred due to intact backup systems that enabled restoration of normal billing operations promptly. The organization filed a formal police report (FIR No. 129/18) at Panchkula's Sector-5 police station on March 23 under Section 66 of India's IT Act (2000) and Section 384 of the Indian Penal Code (extortion). Police investigations commenced under Inspector Karambir Singh with plans to involve specialized cyber crime units. Concurrently, UHBVNL accelerated preexisting plans to replace the legacy AMR system with a technologically advanced platform scheduled for deployment by May 2018, citing enhanced security robustness as a key objective. Historical evidence suggested prior reconnaissance or intrusion attempts by the threat actors before the successful March 21 encryption event.