Employees Connect Nuclear Power Plant To The Internet To Mine Cryptocurrency

The incident was first reported by the English-language Ukrainian news site UNIAN. The episode occurred took place in July at the South Ukraine Nuclear Power Plant at Yuzhnoukrainsk, in southern Ukraine. The employees installed several bitcoin mining equipment at one of the plant’s administrative buildings to take advantage of the uninterruptible electricity from the local grid as well as the plant’s internet connectivity. By doing so, they unintentionally disclosed information on the site’s security arrangements at the nuclear facility. The investigation led by the SBU is looking at the incident as a potential breach of state secrets, as the nuclear power plant is a critical infrastructure and outside computer equipment is not authorized to enter the property. They are also trying to find out if the attackers used the mining rig as an entry point to collect secrets like the plant’s physical defenses and protections. On July 10, 2019, the SBU agents raided the premises of the National Guard, which is the security unit of the nuclear power plant. It found and seized 6 AMD Radeon RX470 graphics cards, PCI risers, power supplies, coolers, a motherboard, a USB flash drive, and a hard drive that were used to mine cryptocurrencies illegally. Further, the frame on which all the mining hardware was fixed was also removed. Additionally, the SBU also raided the premises of the military unit of the National Guard of Ukraine the very same day where they found additional equipments such as 16 GPU video cards, a building block with the identification number of the military unit, 7 hard drives, 2 storage reservoirs, a USB flash drive and a router. The authorities are pursuing criminal proceedings against the South Ukrainian Nuclear Power Plant officials who are believed to have been involved in the crypto mining. If convicted, one can get from 2 to 5 years in prison for the illegal disclosure of state secrets under Article 238 of the Criminal Code of Ukraine. However, the term could change up to 8 years if the disclosure has caused grave consequences.