# Aidon Oy / Gridspertise (Enel Group) — Smart Meter Operations Platform Breach **Date:** September 2026 **Sector:** Critical Infrastructure — Energy / Smart Grid **Country:** Finland **Parent Company:** Gridspertise S.r.l. (joint venture: Enel Group + CVC Capital Partners) --- ## Summary The Smart Meter Operations (SMO) platform operated by **Aidon Oy** — Finland's leading smart metering company and a subsidiary of **Gridspertise** (Enel Group) — has been fully compromised. The platform serves as the central head-end system for dozens of Finnish distribution system operators (DSOs), managing millions of smart electricity meters across the country. Between **April 19 and May 1, 2026**, a total of **9,899 files (8.41 TB)** were extracted from **eight SQL Server instances** within the platform's internal cluster (10.110.4.0/24, legacy domain: empalvelut.dom). This is the largest known breach of smart grid infrastructure in the Nordic region. --- ## By the Numbers | Metric | Value | |--------|-------| | **AES-128 encryption keys** | 520,796 (Unicast / Multicast / Authentication) | | **Citizen PII records** | ~1,500,000 | | **Total data exfiltrated** | 8.41 TB | | **SQL servers compromised** | 8 | | **Databases** | 25+ (~2.4 TB on disk) | | **Full SQL backups (.bak)** | 368 | | **Transaction logs (.trn)** | 9,079 (15-minute intervals — continuous chain) | | **Live database files (.mdf/.ldf/.ndf)** | 218 | | **User accounts with credentials** | 74 (SHA-512 + TOTP secrets + 23 API keys) | | **SIM / IMSI records** | 108,000+ | | **GPS coordinates of metering points** | 91,430+ | | **Affected organizations** | 10+ energy utilities | | **Data period** | 19 April – 1 May 2026 | --- ## What Was Compromised ### 1. Smart Meter Encryption Keys — 520,796 AES-128 keys The **SecurityManager** database contains 520,796 AES-128-CBC encryption keys used to secure communication with smart meters in the field. Three key types are stored per device: - **Unicast** — device-specific encrypted communication - **Authentication** — meter identity verification - **Multicast** — group commands (firmware updates, disconnect/reconnect) Possession of these keys enables: decryption of all mesh network traffic, forging of commands to meters, and remote disconnection of electricity supply across entire regions. This represents an **existential threat to the security claims of Aidon's entire product line** — the company manufactures the meters (ADN6534, ADN7534, ADN7442, ADN6490) and operates the head-end.  ### 2. Personal Data — ~1.5 Million Finnish Citizens Across 11 Meteringware customer data shards, the Vantage platform, and municipal CDAPIDB instances, the following personal data was extracted for approximately 1.5 million individuals: - Full names and home addresses - GPS coordinates of metering points (91,430+ with precision coordinates) - Energy consumption profiles (15-minute intervals) - Customer GUIDs and metering point identifiers - Fuse sizes, meter serial numbers, device configurations This data covers residential and commercial electricity customers across Eastern and Central Finland.   ### 3. User Accounts and Authentication Material — 74 Accounts The **UserManager** database contains 74 operator accounts across multiple organizations: | Domain | Accounts | |--------|----------| | @aidon.com | 31 | | @enerim.com | 17 | | @ese.fi | 9 | | @pbe.fi | 4 | | @savonvoima.fi | 3 | | @keoy.fi | 2 | | Service/API accounts | 8 | Each account includes: SHA-512 password hash, salt, **TOTP secret** (time-based one-time password seed), creation date, and last login timestamp. Additionally, 23 API keys were extracted from the ApiKey table. The TOTP secrets allow real-time generation of valid two-factor authentication codes for any of these accounts. Notable: the account of **Aidon's CTO** is among the compromised records, with a last login of April 24, 2026.   ### 4. Telecom Data — 108,000+ SIM Records The platform stores cellular connectivity data for every smart meter with a SIM module: - SIM IMSI numbers (89358020...) - ICCID identifiers - Phone numbers (+358...) - Device IP:port endpoints (10.83.x.x:9999) - Mesh network topology (RSSI levels, communication roles) - Communication technology flags (Cellular / Radio) ### 5. DSO Client Databases — Per-Utility Isolation Breached Server 10.110.4.216 hosts **six named SQL instances**, each dedicated to a specific distribution system operator: - **PORVOO** — Porvoon Energia - **KERAVA** — Keravan Energia - **KSOY** — Koillis-Savon Yhtiöt - **CST03, CST04** — Municipal DSOs - **TEST** — Test environment Each instance contains: CDAPIDB, VisionAir, and VisionAir_History databases. The per-client isolation model means every DSO's operational data was independently compromised.  --- ## Infrastructure Overview Eight SQL Server instances were compromised on the 10.110.4.0/24 network: | Server | Role | Key Databases | |--------|------|---------------| | 10.110.4.191 | **Main SQL Server** | AidonReports, Meteringware (×11 shards), SecurityManager, UserManager, DataCollector, EventManager, Gateware, Linkware, Middleware | | 10.110.4.216 | Multi-instance (6 DSOs) | CDAPIDB, VisionAir, VisionAir_History per client | | 10.110.4.239 | Vantage Platform | Vantage Data + BR/CR/LP/ME + ReportServer | | 10.110.4.234 | CDAPI + READyManager | READyManagerDB (contains Secrets table), CDAPI_DriverQuartz | | 10.110.4.226 | MSSQL15 | Gateware | | 10.110.4.70 | MSSQL13 | Gateware, meshnet, MitoxAMRReportingDb, RKGateware | | 10.110.4.32 | Gateware | Gateware replica | | 10.110.4.12 | meshnet | Mesh network database | Total: **42 databases**, **5,535 user tables**, **67,888 views**, approximately **2.4 TB** of structured data.     --- ## Corporate Structure **Aidon Oy** (Y-tunnus: 1881960-4) is a Finnish smart metering company headquartered in Jyväskylä. Aidon manufactures smart electricity meters and operates head-end platforms (Meteringware, Gateware, Linkware) as managed services for distribution system operators across Finland and the Nordics. In **September 2023**, Aidon acquired the Smart Meter Operations (SMO) business — the compromised platform — from Enerim Oy. The SMO platform provides automated reading services for smart meters across Finland. In **November 2023**, Aidon was itself acquired by **Gridspertise S.r.l.**, a joint venture between **Enel Group** (Italy, €70B+ revenue) and **CVC Capital Partners**. Gridspertise manages over 100 million smart meters worldwide. The Aidon board includes: - **Marco Zallocco** — Chairman (Gridspertise representative) - **Francesca Pizzarello** — Board member (Gridspertise/Enel) - **Tommi Blomberg** — CEO --- ## Affected Organizations The following energy companies are confirmed clients on the compromised platform, with their customer data present in the extracted databases: | Organization | Type | |-------------|------| | Porvoon Energia | Municipal electricity utility (Porvoo) | | Keravan Energia | Municipal electricity utility (Kerava) | | KSOY (Koillis-Savon Yhtiöt) | Regional electricity utility | | Etelä-Savon Energia (ESE) | Regional electricity utility (Mikkeli) | | Savon Voima | Regional electricity utility | | PBE (Porvoon Energia subsidiary) | Electricity distribution | | KEOY | Electricity distribution | | Voimatel | Energy services | | Joroisten Energialaitos | Municipal utility (Joroinen) | | Helen Oy | Helsinki electricity utility | The Vantage platform alone lists **3,037 customer entries** across dozens of Finnish energy companies, municipalities, and housing associations. --- ## Regulatory Exposure | Regulation | Impact | |-----------|--------| | **GDPR** | ~1.5 million data subjects. Art.33: 72-hour DPA notification. Art.34: mandatory individual notification. Fines up to 4% of global turnover. | | **NIS2 Directive** | Smart metering = critical infrastructure. Mandatory incident reporting to Traficom / NCSC-FI. Fines up to €10M or 2% of turnover. C-level personal liability. | | **Finnish Law** | Sähkömarkkinalaki (Electricity Market Act). Tietosuojalaki (Data Protection Act). Fingrid Datahub connection obligations. | Each affected DSO has **independent GDPR notification obligations** once they become aware their customer data was compromised on a third-party platform. This creates a cascade of mandatory regulatory disclosures. **Estimated total exposure: >€20,000,000** across GDPR fines, client contract losses, meter key rotation costs, and reputational damage to Gridspertise's global operations.  --- ## Timeline  | Date | Event | |------|-------| | 19 April 2026 | Initial access to SQL cluster | | 19 Apr – 1 May | Continuous exfiltration: 9,899 files, 8.41 TB | | 1 May 2026 | Exfiltration complete | | July 2026 | Initial contact sent to wrong entity (legacy domain confusion) | | 15 August 2026 | Attribution corrected — Aidon Oy identified as platform operator | | ~20 August 2026 | CEO and CFO of Aidon contacted directly with proof | | September 2026 | **No response received** | --- ## Proof Samples The following are representative samples only. Full datasets are retained. - **AES-128 encryption keys** — masked samples from SecurityManager.KeyInfos (520,796 records) - **User accounts** — Aidon, Enerim, and DSO operator accounts with masked credentials - **GPS metering points** — addresses and coordinates of 91,430+ installations - **Consumer PII** — names, addresses, meter serials, phone numbers (partially masked) - **Backup file listing** — 368 full backups + 9,079 transaction logs with timestamps - **Server certificate** — MS_AgentSigningCertificate with verifiable GUID - **DSO client instances** — per-utility SQL databases (PORVOO, KERAVA, KSOY, CST03, CST04) Data will not be published while a resolution remains possible.