Insurer pays $25,000 cyber ransom for Michigan utility
The Lansing Board of Water & Light in Illinois paid a $25,000 ransom to unlock its internal communication systems after it was attacked by ransomware last spring. The cost of responding to the emergency, including cybersecurity upgrades and the ransom, totalled $2.4m, according to the general manager. The utility company has filed an insurance claim with AIG and the Illinois National Insurance Company under its multi-layered CyberEdge policy.
Ken Palmer

Lansing State Journal

LANSING – The Lansing Board of Water & Light paid a $25,000 ransom to unlock its internal communications systems after they were disabled by a cyber attack last spring, officials said Tuesday.

BWL General Manager Dick Peffley pegged the cost of responding to the emergency, including the ransom and technology upgrades to prevent future attacks, at $2.4 million. All but $500,000 of those costs are covered by insurance, he said.

“Paying the ransom was distasteful and disgusting, but sadly necessary,” Peffley said during a meeting of the BWL Board of Commissioners’ Committee of the Whole on Tuesday night. Paying the ransom was “the only action we could take to unlock our system and free it from the ransomware.”

►Related:Holiday shoppers warned about fake apps and fraud

The April 25 cyber attack shut down BWL’s accounting and e-mail systems after an employee unknowingly opened an e-mail with an infected attachment.

The attack also forced the utility to shut down phone lines, including a customer service line often used for account inquiries. It took about a week for the utility to recover from the disruption. BWL officials said there is no evidence that customers’ or employees’ personal information was compromised. The breach did not affect electric and water distribution, they said.

Officials had previously said the attack cost the utility around $2 million. But they didn’t acknowledge that a ransom was paid until Tuesday.

BWL has filed a $1.9 million insurance claim for losses resulting from the attack. Peffley said. That figure represents $2 million in covered losses, minus a $100,000 deductible, he said. The claim has not yet been paid, officials said.

Records obtained from BWL by the State Journal in a Freedom of Information Act request show the utility had a multi-layered “CyberEdge” insurance policy with AIG and the Illinois National Insurance Co. at the time of the attack. The policy included coverage for network interruption and cyber extortion, along with other types of protection.

The $2.4 million in costs resulting from the attack included the cost of a cyber-emergency response team, crisis management and stabilizing and restoring its systems, BWL officials said. It also included the cost of “mitigation and enhanced cyber-security personnel and technologies,” they said.

Peffley and other staff members delivered an update about the cyber attack to the board committee during a closed session on Tuesday night. Peffley read a public statement after the committee resumed its open meeting.

With little discussion, committee members voted unanimously to send a proposed new information technology communication policy to the full board for approval.

The new policy would replace one adopted in 2007 and is intended to improve the security and integrity of BWL’s systems, utility officials said.

Contact Ken Palmer: 517-377-1032 or kpalmer@lsj.com