Yazoo Valley Electric Power Association said that the data security incident it suffered last year compromised the sensitive personal information of almost 21,000 individuals.
Based in Yazoo City, Mississippi, Yazoo Valley Electric is a rural electric power utility that supplies electricity to six counties in Mississippi, namely Yazoo, Holmes, Warren, Issaquena, Sharkey, and Humphreys.
In a data breach notice filed with the Office of Maine Attorney General, YVEPA said that on August 26, it identified suspicious activity in its internal network. The electricity provider immediately launched an investigation, with assistance from external cyber security experts to determine the nature and scope of the incident.
“A thorough investigation determined that an unauthorised actor accessed certain files on our network. We then conducted a thorough review of the potentially impacted data to determine the types of information contained therein and to whom the information related,” the power utility said.
“On October 24, 2024, we completed our review and determined that a limited amount of personal information may have been accessed by an unauthorised party in connection with this incident,” it added.
The compromised data included names and other personal identifiers including Social Security numbers. Yazoo Valley Electric’s filing with the Maine state regulator revealed that the cyber security incident impacted at least 20,997 individuals across the six counties.
“We have taken steps to address the incident and are committed to protecting the information entrusted to us. Upon learning of this event, we took steps to strengthen our network security and conducted a thorough investigation,” YVEPA added.
The electricity provider has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and state attorney general.
It has also offered one year of complimentary identity protection and credit monitoring services through TransUnion to all affected individuals.
In November, the infamous Akira ransomware group recently claimed responsibility for the ransomware attack on YVEPA and listed it as a victim on its data leak site.
The group claimed to be in possession of confidential data stolen from the company, including Social Security numbers and financial records and threatened to leak the same if its ransom demands aren’t met. It is unclear if the company negotiated with the ransomware group or paid a ransom.
