Cyber Incident Victim: Air-e
Date:
Sep 2024
Location:
Colombia
Summary
A utility company experienced a zero-day ransomware attack disrupting critical systems, including its commercial platform and user request archives, leading to suspended response timelines for customer complaints and petitions under force majeure provisions. The incident prompted legal notifications to authorities, with operational impacts allowing continued submission of grievances through physical or virtual channels but delaying resolutions; failure to restore systems may extend the suspension period.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In September 2024, Air-e, a public utility company under intervention, experienced a significant cyberattack that disrupted its operations. The incident involved a "RANSOMWARE DIA CERO" (zero-day ransomware) attack, described by the company as sophisticated and unprecedented in its history. This attack compromised critical systems, including the commercial platform OPEN SMARTFLEX and file storage infrastructure containing user request documentation. Air-e formally suspended statutory response timelines for petitions, complaints, and claims on September 1, invoking "force majeure" provisions under Colombia's Laws 142 and 143 of 1994, along with other sector regulations. The suspension exempted the company from its standard 15-day response obligation until November 30, 2024, explicitly excluding the application of positive administrative silence during this period.
Air-e initiated legal protocols by filing a criminal complaint with the Fiscalía General on September 3, followed by regulatory notification to the Superintendencia de Servicios Públicos Domiciliarios on September 5. The suspension applied universally to all pending and newly submitted requests across Air-e's service territories in Atlántico, Magdalena, and La Guajira. While customers retained the ability to submit complaints through physical and virtual channels, response times became indeterminate due to system unavailability. The company publicly acknowledged the possibility of extending the suspension beyond November 30 if system restoration efforts proved unsuccessful. Operational impacts centered on the incapacitation of request-processing infrastructure, though no data breaches or service interruptions beyond administrative timelines were disclosed in available reporting.