Onslow Water and Sewer Authority

Onslow Water and Sewer Authority (ONWASA) is a water and sewer authority operating in the United States of America. The organization provides drinking water and wastewater treatment services to its service area. Its headquarters are located in the United States, as indicated in the organization’s official description.

In October 2018, ONWASA was targeted by a sophisticated ransomware attack that followed a hurricane affecting the region. The attack initially involved Emotet malware infections on internal computers and servers. Emotet’s polymorphic banking Trojan capabilities were used to deliver the Ryuk ransomware strain. Ryuk, known for tailored intrusions rather than broad spam distribution, was deployed onto ONWASA’s systems. The ransomware caused significant disruption to internal infrastructure, limiting the organization’s operational capabilities. Despite the disruption, customer data, environmental safety, and water supply remained uncompromised. To restore functionality, ONWASA undertook extensive database reconstruction efforts with assistance from external security experts. Internal IT teams collaborated with the external specialists to mitigate the attack and return systems to normal operation. The incident highlighted the importance of cybersecurity resilience for water and sewer utilities facing natural disaster aftermath.