aidon.com

Kurum hakkında

# Aidon Oy / Gridspertise (Enel Group) — Smart Meter Operations Platform Breach **Date:** September 2026 **Sector:** Critical Infrastructure — Energy / Smart Grid **Country:** Finland **Parent Company:** Gridspertise S.r.l. (joint venture: Enel Group + CVC Capital Partners) --- ## Summary The Smart Meter Operations (SMO) platform operated by **Aidon Oy** — Finland's leading smart metering company and a subsidiary of **Gridspertise** (Enel Group) — has been fully compromised. The platform serves as the central head-end system for dozens of Finnish distribution system operators (DSOs), managing millions of smart electricity meters across the country. Between **April 19 and May 1, 2026**, a total of **9,899 files (8.41 TB)** were extracted from **eight SQL Server instances** within the platform's internal cluster (10.110.4.0/24, legacy domain: empalvelut.dom). This is the largest known breach of smart grid infrastructure in the Nordic region. --- ## By the Numbers Metric Value |--------|-------| **AES-128 encryption keys** 520,796 (Unicast / Multicast / Authentication) **Citizen PII records** ~1,500,000 **Total data exfiltrated** 8.41 TB **SQL servers compromised** 8 **Databases** 25+ (~2.4 TB on disk) **Full SQL backups (.bak)** 368 **Transaction logs (.trn)** 9,079 (15-minute intervals — continuous chain) **Live database files (.mdf/.ldf/.ndf)** 218 **User accounts with credentials** 74 (SHA-512 + TOTP secrets + 23 API keys) **SIM / IMSI records** 108,000+ **GPS coordinates of metering points** 91,430+ **Affected organizations** 10+ energy utilities **Data period** 19 April – 1 May 2026 --- ## What Was Compromised ### 1. Smart Meter Encryption Keys — 520,796 AES-128 keys The **SecurityManager** database contains 520,796 AES-128-CBC encryption keys used to secure communication with smart meters in the field. Three key types are stored per device: - **Unicast** — device-specific encrypted communication - **Authentication** — meter identity verification - **Multicast** — group commands (firmware updates, disconnect/reconnect) Possession of these keys enables: decryption of all mesh network traffic, forging of commands to meters, and remote disconnection of electricity supply across entire regions. This represents an **existential threat to the security claims of Aidon's entire product line** — the company manufactures the meters (ADN6534, ADN7534, ADN7442, ADN6490) and operates the head-end.  ### 2. Personal Data — ~1.5 Million Finnish Citizens Across 11 Meteringware customer data shards, the Vantage platform, and municipal CDAPIDB instances, the following personal data was extracted for approximately 1.5 million individuals: - Full names and home addresses - GPS coordinates of metering points (91,430+ with precision coordinates) - Energy consumption profiles (15-minute intervals) - Customer GUIDs and metering point identifiers - Fuse sizes, meter serial numbers, device configurations This data covers residential and commercial electricity customers across Eastern and Central Finland.   ### 3. User Accounts and Authentication Material — 74 Accounts The **UserManager** database contains 74 operator accounts across multiple organizations: Domain Accounts |--------|----------| @aidon.com 31 @enerim.com 17 @ese.fi 9 @pbe.fi 4 @savonvoima.fi 3 @keoy.fi 2 Service/API accounts 8 Each account includes: SHA-512 password hash, salt, **TOTP secret** (time-based one-time password seed), creation date, and last login timestamp. Additionally, 23 API keys were extracted from the ApiKey table. The TOTP secrets allow real-time generation of valid two-factor authentication codes for any of these accounts. Notable: the account of **Aidon's CTO** is among the compromised records, with a last login of April 24, 2026.   ### 4. Telecom Data — 108,000+ SIM Records The platform stores cellular connectivity data for every smart meter with a SIM module: - SIM IMSI numbers (89358020...) - ICCID identifiers - Phone numbers (+358...) - Device IP:port endpoints (10.83.x.x:9999) - Mesh network topology (RSSI levels, communication roles) - Communication technology flags (Cellular / Radio) ### 5. DSO Client Databases — Per-Utility Isolation Breached Server 10.110.4.216 hosts **six named SQL instances**, each dedicated to a specific distribution system operator: - **PORVOO** — Porvoon Energia - **KERAVA** — Keravan Energia - **KSOY** — Koillis-Savon Yhtiöt - **CST03, CST04** — Municipal DSOs - **TEST** — Test environment Each instance contains: CDAPIDB, VisionAir, and VisionAir_History databases. The per-client isolation model means every DSO's operational data was independently compromised.  --- ## Infrastructure Overview Eight SQL Server instances were compromised on the 10.110.4.0/24 network: Server Role Key Databases |--------|------|---------------| 10.110.4.191 **Main SQL Server** AidonReports, Meteringware (×11 shards), SecurityManager, UserManager, DataCollector, EventManager, Gateware, Linkware, Middleware 10.110.4.216 Multi-instance (6 DSOs) CDAPIDB, VisionAir, VisionAir_History per client 10.110.4.239 Vantage Platform Vantage Data + BR/CR/LP/ME + ReportServer 10.110.4.234 CDAPI + READyManager READyManagerDB (contains Secrets table), CDAPI_DriverQuartz 10.110.4.226 MSSQL15 Gateware 10.110.4.70 MSSQL13 Gateware, meshnet, MitoxAMRReportingDb, RKGateware 10.110.4.32 Gateware Gateware replica 10.110.4.12 meshnet Mesh network database Total: **42 databases**, **5,535 user tables**, **67,888 views**, approximately **2.4 TB** of structured data.     --- ## Corporate Structure **Aidon Oy** (Y-tunnus: 1881960-4) is a Finnish smart metering company headquartered in Jyväskylä. Aidon manufactures smart electricity meters and operates head-end platforms (Meteringware, Gateware, Linkware) as managed services for distribution system operators across Finland and the Nordics. In **September 2023**, Aidon acquired the Smart Meter Operations (SMO) business — the compromised platform — from Enerim Oy. The SMO platform provides automated reading services for smart meters across Finland. In **November 2023**, Aidon was itself acquired by **Gridspertise S.r.l.**, a joint venture between **Enel Group** (Italy, €70B+ revenue) and **CVC Capital Partners**. Gridspertise manages over 100 million smart meters worldwide. The Aidon board includes: - **Marco Zallocco** — Chairman (Gridspertise representative) - **Francesca Pizzarello** — Board member (Gridspertise/Enel) - **Tommi Blomberg** — CEO --- ## Affected Organizations The following energy companies are confirmed clients on the compromised platform, with their customer data present in the extracted databases: Organization Type |-------------|------| Porvoon Energia Municipal electricity utility (Porvoo) Keravan Energia Municipal electricity utility (Kerava) KSOY (Koillis-Savon Yhtiöt) Regional electricity utility Etelä-Savon Energia (ESE) Regional electricity utility (Mikkeli) Savon Voima Regional electricity utility PBE (Porvoon Energia subsidiary) Electricity distribution KEOY Electricity distribution Voimatel Energy services Joroisten Energialaitos Municipal utility (Joroinen) Helen Oy Helsinki electricity utility The Vantage platform alone lists **3,037 customer entries** across dozens of Finnish energy companies, municipalities, and housing associations. --- ## Regulatory Exposure Regulation Impact |-----------|--------| **GDPR** ~1.5 million data subjects. Art.33: 72-hour DPA notification. Art.34: mandatory individual notification. Fines up to 4% of global turnover. **NIS2 Directive** Smart metering = critical infrastructure. Mandatory incident reporting to Traficom / NCSC-FI. Fines up to €10M or 2% of turnover. C-level personal liability. **Finnish Law** Sähkömarkkinalaki (Electricity Market Act). Tietosuojalaki (Data Protection Act). Fingrid Datahub connection obligations. Each affected DSO has **independent GDPR notification obligations** once they become aware their customer data was compromised on a third-party platform. This creates a cascade of mandatory regulatory disclosures. **Estimated total exposure: >€20,000,000** across GDPR fines, client contract losses, meter key rotation costs, and reputational damage to Gridspertise's global operations.  --- ## Timeline  Date Event |------|-------| 19 April 2026 Initial access to SQL cluster 19 Apr – 1 May Continuous exfiltration: 9,899 files, 8.41 TB 1 May 2026 Exfiltration complete July 2026 Initial contact sent to wrong entity (legacy domain confusion) 15 August 2026 Attribution corrected — Aidon Oy identified as platform operator ~20 August 2026 CEO and CFO of Aidon contacted directly with proof September 2026 **No response received** --- ## Proof Samples The following are representative samples only. Full datasets are retained. - **AES-128 encryption keys** — masked samples from SecurityManager.KeyInfos (520,796 records) - **User accounts** — Aidon, Enerim, and DSO operator accounts with masked credentials - **GPS metering points** — addresses and coordinates of 91,430+ installations - **Consumer PII** — names, addresses, meter serials, phone numbers (partially masked) - **Backup file listing** — 368 full backups + 9,079 transaction logs with timestamps - **Server certificate** — MS_AgentSigningCertificate with verifiable GUID - **DSO client instances** — per-utility SQL databases (PORVOO, KERAVA, KSOY, CST03, CST04) Data will not be published while a resolution remains possible.

Infostealer loglarında görülen hesaplar

Bu kuruma ait hesap bilgileri, saldırı öncesinde infostealer zararlı yazılım loglarında tespit edildi. Bu loglar saldırganların ilk erişim için kullandığı kaynaklardan biridir.

Çalışan hesabı

1

Üçüncü taraf hesabı

6

Son güncelleme: 12.11.2026

Incransom grubunun son saldırıları

• Chicago History Museum08.09.2026 · ABD
• Zito Marketi04.09.2026 · Kuzey Makedonya
• Partners Financial Services, a.s.11.09.2026 · Çek Cumhuriyeti
• Roane Transportation Services21.09.2026 · ABD
• Kolin27.09.2026 · Türkiye
• Nota Groep29.09.2026 · Hollanda