The Puerto Rico Water and Sewer Authority (PRASA) is actively investigating a security incident that occurred last week. During the attack, which became known on March 19, the attackers gained access to some information about the company’s customers and employees. PRASA has already notified the victims of the leak and involved the US FBI and CISA.

At the moment, the official investigation has not yet revealed the name of the hacker group behind this attack, but the Vice Society ransomware gang has added PRASA to the list of victims on their dark web site with data leaks. The gang made public the passports, driver’s licenses and other documents of the victims.

“Since the investigation into the incident is still ongoing, we cannot comment in detail. However, we are ready to assure all our customers that we continue to work to provide quality and efficient services,” said Doriel Pagan, Executive President of PRASA. In general, the statement seems to be true, because the cyber attack was not aimed at disrupting water supply systems. It seems that the hackers were primarily interested in collecting confidential information.

According to the US Environmental Protection Agency (US EPA), water systems are critical infrastructures that are increasingly at risk of attacks from both independent cybercriminals and government-sponsored hackers.

Recent safety audits have shown that public water utilities tend to have weak security systems, US government officials say. And employees of such enterprises lack theoretical knowledge and practical skills in the field of cybersecurity, which makes them vulnerable to social engineering attacks.