Cyber-Crook Claims Data Was Stolen From Major Utilities

The Register’s Jessica Lyons reports that a cyber-criminal (or group) claims to have breached a Florida-based engineering firm, Pickett and Associates, which provides design and mapping services to major utilities in the US.

A large cache of allegedly stolen engineering data belonging to Tampa Electric Company, Duke Energy Florida, and American Electric Power is for sale on the dark web. The seller is asking 6.5 bitcoin, valued at approximately $585,000, and claims the material relates to active infrastructure projects involving multiple electricity providers.

The allegations have not been independently confirmed, and some affected parties are still assessing the claims.

Pickett and Associates, headquartered in Tampa, supplies transmission and distribution design, surveying, aerial mapping, and LiDAR services to utilities and mining operations across the United States and the Caribbean. The attacker claims to have obtained 892 files totaling about 139 GB.

According to the dark web offer, the data includes raw LiDAR point clouds, detailed transmission line and substation coverage, high-resolution orthophotos, design files, vegetation data, and other materials associated with ongoing utility projects. Four sample files were offered as proof.

Customer counts cited by the criminal actor range from hundreds of thousands to several million across multiple states. Duke Energy confirmed it is investigating the claims. Pickett and Associates and other utilities did not respond. The same seller is also advertising what it claims is an internal database from a European solar energy company.

For lawyers, the incident raises issues of third-party risk, verification of breach claims, and disclosure obligations. Allegations involving utilities and detailed infrastructure data can trigger regulatory scrutiny, contractual exposure, and litigation risk even before facts are established.

Counsel advising engineering firms and asset owners must be prepared to manage investigations, communications, and preservation obligations while treating unverified criminal assertions.