On August 5, 2022, WECC Holdings, Inc., which does business under the name Watson Electrical, reported a data breach with a state attorney general’s office, explaining that, as a result of a recent ransomware attack, certain consumer data may have ended up in the hands of hackers. Because the Watson Electrical breach was only announced very recently, it has not been confirmed which types of data were compromised. However, after confirming the breach and identifying all affected parties, Watson Electrical began sending out data breach letters to all affected parties. These notices should provide consumers with the specific data types that were leaked and what they can do to protect themselves from identity theft and other frauds.

If you received a data breach notification, it is essential you understand what is at risk and what you can do about it. To learn more about how to protect yourself from becoming a victim of fraud or identity theft and what your legal options are in the wake of the Watson Electrical data breach, please see our recent piece on the topic here.

What We Know About the Watson Electrical Data Breach

The information about the Watson Electrical data breach comes from documents filed with the Vermont Attorney General’s Office. According to the most recently available data, on May 27, 2022, Watson Electrical discovered that it had been the target of a sophisticated ransomware attack impacting the functionality of the company’s IT network. In response, the company secured its network, contacted law enforcement, and then arranged to have a third-party cybersecurity firm conduct an investigation into the incident.

The company’s investigation revealed that an unauthorized party gained access to files on the Watson Electrical network that contained personal information belonging to certain individuals. After discovering that sensitive consumer data was accessible to an unauthorized party, Watson Electrical began the process of reviewing all affected files to determine what information was compromised and which consumers were impacted by the incident. Watson Electrical completed this review on July 20, 2022.

On August 5, 2022, Watson Electrical sent out data breach letters to all individuals whose information was compromised as a result of the recent data security incident.

More Information About Watson Electrical

Founded in 1935, Watson Electrical is a residential and commercial construction company based in Wilson, North Carolina. Watson Electrical is a subsidiary of WECC Inc., a general contracting company that is also based in North Carolina. Watson Electrical provides residential and commercial clients with varied electrical services, including pre-construction planning, construction, as well as ongoing maintenance. Watson Electrical maintains 10 locations across North Carolina, South Carolina, Virginia and California. Watson Electrical employs more than 637 people and generates approximately $145 million in annual revenue.

Can Companies Prevent Ransomware Attacks?

Yes, most ransomware attacks are preventable; however, identifying and quickly neutralizing these threats requires an organization to not only implement a robust data security system but also to commit to providing employees with ongoing training to educate them on the dangers of ransomware and email phishing attacks.

Ransomware attacks, along with email phishing campaigns, are the two most common types of cyberattacks. According to the Identity Theft Resource Center (ITRC), ransomware attacks against U.S. victims more than doubled between 2020 and 2021, from 158 to 321. So far, in 2022, there have been approximately 175 ransomware attacks, meaning we may surpass the number of attacks in 2021.

Hackers can carry out ransomware attacks in several ways. Traditionally, a ransomware attack involves a hacker installing malicious software on the victim’s computer network, usually after they click on a malicious link or provide their login credentials in response to a phishing email. This malicious software encrypts the data on the victim’s device, preventing them from accessing their computer. The malware also provides hackers with access to the data on the victim’s computer network.

When a target attempts to log back into their computer, they will see a note from the hackers advising them that they must pay a ransom if they want to regain access. In most cases, hackers orchestrate ransomware attacks to force companies to pay a monetary ransom. Hackers also frequently threaten to publicly post the information they stole on the Dark Web as a punishment for companies that choose not to pay the ransom.

The FBI is very aware of the threat that ransomware attacks pose and provides guidance to organizations on how to reduce the chances of being targeted. According to the FBI’s most recent guidance, here are a few ways companies can lower the likelihood of becoming a ransomware target:

• Do not open unsolicited emails, attachments or click on the link contained in these emails;

• Ensure copies are uploaded to the cloud or downloaded to an external hard drive whenever backing up data;

• Implement least privilege for file, directory, and network share permissions;

• Install (and regularly update) cutting-edge anti-virus or anti-malware software on all devices;

• Only use secure networks and avoid using public Wi-Fi networks;

• Secure back-ups to ensure data is not accessible from the system where the original data is kept;

• Use authenticator apps rather than email because cybercriminals may gain control of employee email accounts; and

• Use multi-factor authentication whenever possible.

Thus, while ransomware attacks are preventable, it requires organizations to expend significant effort and expense. However, this is a justifiable cost of doing business in an environment where the threat of cyberattacks is constant.