Document 3 From Tarduggno Matthew To Exam Eden 5 Lotto adn'egoe Cc Kenneth Bueii Kumar Puesh Samoan FollowelJp on Denial of Service Incident Date Friday March as 2019 seem PM USE ONLY All i wanted to quickly followup on the deniai of-seryice incident experienced by sPower a company that owns and operators solar and wind generation assets in several states that we noted this morning 1 spoke with the operations manager of sPower this morning and the has also been in contact with the company On March 5 sPower noted a series of brief communication outages between their control center and their remote sites Upon further investigation the communications outages were determined to have been caused by firewaii reboots After consulting with Cisco the firewali manufacture it was determined that the rewall reboots were caused by a Dos attack exploding a known Cisco recommended a firmware update which sPower has been deploying across their system after testing for compatibility The incdent was observed intermittentiy over a 12 hour period and no further activity has been observed since this time sPower has reviewed iog files and has found no evidence of a breach beyond the attack Additionaily the incident did not have any impacts on operations When 1 spoke with sPower they did not expect to need any additionai support or have any ongoing concerns however they will contact us if there are any issues 03 WE We have been providing Office of intelligence and Counterinteiligence with updates and they are ready to investigate any indicators as appropriate and have been checking for any related incidents We wili work with and the to provide appropriate information to the sector as available Please let me know if you have any questions Best Regards wMatt Matthew T Ferd uogno Infrastructure Security 81 Energy Restoration Office of Cybersecurity Energy Security Emergency Response US Department of Energy Office 202 586-2892 I Mobile b 6 Matthew Tarduogno@hq doe gov OFFICIAL USE ONLY