Cyber Incident Victim: GEBE
Date:
Mar 2022
Location:
Sint Maarten
Summary
A ransomware attack attributed to the BlackByte group disrupted the computer systems of a utilities company, prompting an active investigation and incident response. While electrical and water distribution networks remained operational, the attack forced office closures and rendered online customer portals inaccessible, requiring alternative payment methods via online banking with manual verification through WhatsApp or live chat. Temporary in-person procedures were implemented for account terminations, relocations, new connections, and installment plans. The company focused on restoring systems and minimizing customer impact, urging continued payments during recovery efforts and maintaining communication via phone and digital channels.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On March 17, 2022, NV GEBE, the utilities provider for St. Maarten, experienced a BlackByte ransomware cyberattack that disabled its computer systems. The company immediately initiated an active investigation and incident response process, though it declined to disclose technical specifics during the initial phase. Interim Manager Merrill Temmer acknowledged the extensive damage caused by the attack, emphasizing the growing vulnerability of organizations to such threats. GEBE confirmed its electrical and water distribution networks remained operational despite the IT system compromise, allowing continued service delivery to customers. Restoration efforts prioritized minimizing operational disruptions but were expected to require significant time, with no immediate resolution timeline provided.
The attack forced GEBE to close its offices to the public, suspending standard billing and account management processes. Customers were instructed to pay bills via online banking or direct deposit, requiring inclusion of contract account numbers for payment attribution since the GEBE MyLogin portal remained inoperable. Temporary procedures were established for critical services: customers seeking account closures submitted physical requests with bills and ID at offices, while those relocating or requesting new connections completed paper application forms with old bills. Disconnected customers could regain service by submitting online payment proofs via WhatsApp (+1(721)588-3117) or live chat. Customers without bills were advised to estimate and pay monthly amounts electronically. GEBE maintained customer support through phone (+1(721)546-1100/546-1160), WhatsApp, and live chat, urging continued payments to facilitate recovery. Temmer publicly thanked employees for their dedication during the crisis and assured customers the company was working expeditiously to restore normal operations.