Puerto Rico’s Power Distributor Suffered a Cyberattack Hours Before a Devastating Fire

Denial-of-service attacks swarm requests at systems in huge volumes, attempting to overload their capacity to take them down. Attackers flooded Luma’s systems with more than 2 million hits per second, the company said.

The attack was discovered around midday Thursday, said Wayne Stensby, Luma’s president and chief executive, in an interview broadcast live on

Facebook

Thursday afternoon, just hours before the fire.

“We are aware there was targeted denial-of-service [attacks] on our website in the last few days,” he said. “We’ve let the authorities know,” he added. The company didn’t immediately comment further.

Luma said in a statement on its website Friday it hasn’t determined the cause of a fire that ignited at 6:11 p.m. Thursday at a substation in the Monacillo section of San Juan. An explosion was heard as flames reached high above the electrical equipment at the facility, according to video footage obtained by The Wall Street Journal.

The incident knocked out power for 900,000 residents, with about 36,000 still without power as of Friday morning.

Emergency crews spent more than seven hours working to stabilize the power system, the company said. The fire and the cyberattack haven’t been linked.

The Federal Bureau of Investigation’s San Juan office is seeking information about the power outages, according to a notice on social media.

Even before Thursday’s cyberattack, customers were frustrated with long wait times when trying to access their accounts online, said Mr. Stensby in the Facebook interview.

Puerto Rico residents complained on social media of waits of an hour or more.

Luma, a consortium of infrastructure and engineering service providers

Quanta Services Inc.

and Innovative Emergency Management Inc. in the U.S. and

Atco Ltd.

in Canada, is managing electricity for the government-run Puerto Rico Electric Power Authority, which is bankrupt and has struggled for years to keep outages at bay.

Luma created its mobile app after customers inundated the call center in recent weeks, as the consortium geared up to take over energy transmission, Mr. Stensby said.

The attack on Luma is the latest in a string of cyber assaults that have targeted critical infrastructure operators in recent months. In May, criminals infected systems at Colonial Pipeline Co. with ransomware, resulting in a six-day shutdown of the largest energy pipeline on the U.S. East Coast. The U.S. operations of meat-processing giant

JBS SA

also were hit with a ransomware attack over the Memorial Day weekend.

These attacks have prompted warnings from the White House to private-sector companies to improve their cybersecurity defenses, and Congress to hold hearings this week with Colonial Pipeline CEO

Joseph Blount.

Even before the fire, various sections of Puerto Rico have periodically been without power on an almost daily basis for weeks, residents say. Luma has been under scrutiny since formally taking control of electricity transmission and distribution on the island on June 1.

“Part of the dilemma in these first few weeks is the [power] system is so fragile,” Mr. Stensby said in the Facebook interview. Luma was awarded the contract in June 2020.

Write to Kim S. Nash at [email protected] and James Rundle at [email protected]