Luma Energy LLC

Summary

A cyberattack targeted Puerto Rico's primary power distributor, Luma Energy LLC, shortly before a substation fire in San Juan triggered extensive blackouts affecting hundreds of thousands of residents. The incident disrupted critical infrastructure operations, compounding service interruptions across the region during a period of heightened vulnerability. The company confirmed both events occurred in close succession but did not specify a direct link between the cyber incident and the subsequent physical damage.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On June 10, 2021, Puerto Rico’s primary power distributor, Luma Energy LLC, reported experiencing a cyberattack shortly before a major fire erupted at a substation in San Juan. The cyber incident occurred hours prior to the physical infrastructure failure, though the company did not specify the exact timing or nature of the attack. The subsequent fire at the substation triggered widespread power outages across the region, affecting hundreds of thousands of residents and businesses. Luma Energy publicly acknowledged both events—the cyberattack and the fire—as separate occurrences but did not confirm any operational or causal relationship between them. The company’s disclosure emphasized the sequential timing of the incidents without attributing the fire to malicious cyber activity. No further technical details regarding the attack vector, threat actor, or compromised systems were provided in the initial statement. The fire caused immediate operational disruptions, forcing emergency response teams to address the physical damage while cybersecurity personnel investigated the digital intrusion.

The combined incidents resulted in one of the most significant power disruptions in Puerto Rico since Hurricane Maria, with restoration efforts complicated by both the substation damage and ongoing cybersecurity assessments. Luma Energy coordinated with local authorities to manage the crisis, prioritizing grid stabilization and public safety communications. The blackouts persisted for an extended period across multiple municipalities, impacting critical services and daily life. No ransomware claims or threat actor attributions were publicly reported in connection with the cyberattack at the time of the disclosure. The company maintained its focus on restoring power and investigating the incidents separately, without releasing additional forensic findings or mitigation specifics. Public concern escalated due to the compounding emergencies, highlighting vulnerabilities in the territory’s energy infrastructure. Luma Energy’s response remained procedural, centered on incident containment and infrastructure recovery.

Sources

Sources available to members: 1 source.