Cyber Incident Victim: Eletronuclear
Date:
Feb 2021
Location:
Brazil
Summary
A ransomware cyberattack targeted the administrative network of a Brazilian nuclear power subsidiary, though operational systems at its nuclear plants remained unaffected. The subsidiary suspended certain administrative software to safeguard data integrity, with no disruption to plant operations reported. Government entities responsible for nuclear security are investigating the incident.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 2 actors | Available to members | Available to members |
Description
On February 4, 2021, Brazilian state-controlled power company Centrais Eletricas Brasileiras (Eletrobras) disclosed that its nuclear subsidiary Eletronuclear suffered a ransomware cyberattack. The company confirmed the incident in a securities filing submitted late on February 3, 2021, clarifying that the compromised network was segregated from operational technology systems supporting the Angra 1 and Angra 2 nuclear power plants. No reactor operations, safety systems, or critical infrastructure were impacted by the intrusion. Eletronuclear implemented immediate containment measures by voluntarily suspending use of certain administrative software applications to prevent potential data exfiltration or lateral movement within corporate networks. The subsidiary maintained normal power generation activities throughout the incident.
Brazilian government agencies responsible for nuclear security initiated an investigation into the attack, though no threat actor group or specific malware variant was identified in public disclosures. The ransomware affected non-industrial administrative networks, disrupting routine corporate functions but causing no reported data leaks or physical consequences. Eletrobras emphasized the segregation between compromised IT systems and operational plant controls in its public statements. Eletronuclear maintained continuity of nuclear power production while restoring affected administrative systems through undisclosed remediation procedures. The incident concluded without operational disruptions or safety compromises at Brazil's nuclear facilities, with investigations remaining ongoing at the time of reporting.