SCOTLAND’S auditor general has revealed that a huge cyber attack on the Scottish Environmental Protection Agency (Sepa) was carried out after “human error” allowed criminals to access systems.

Sepa suffered a huge ransomware attack on Christmas Eve in 2020 which led to around 1.2GB of data, amounting to at least 4,000 files, being stolen.

An investigation by Police Scotland concluded it likely that an international serious organised crime group was responsible for the extortion attempt.

Auditor general Stephen Boyle told MSPs on Holyrood’s Public Audit Committee that “the majority of Sepa’s data, including underlying financial records were encrypted, stolen or lost”.

He added: “Sepa had to recreate accounting records from bank and HMRC records. This made it difficult for the auditor to gain sufficient evidence to substantiate around £42m of its income from contracts."

READ MORE: Scottish ransomware attack 'likely' to be aimed at extorting public funds

Mr Boyle also said that “the backups were also lost or hacked”, and a “disclaimer” has been placed on the organisation's audit, which he said was a “very unusual” move.

MSPs were told that Sepa was “able to prioritise and deliver some of its critical services within 24 hours of the attack”, but Mr Boyle added that “over 12 months on for the attack, it continues to rebuild and reinstate some of its systems”.

He said: “The full financial impact is not yet known.

“Sepa will therefore continue to face financial and operational challenges in the years to come.”

The quango’s latest financial documents estimate a “budget gap” of between £6 million and £17 million by 2024 with 50 full time equivalent jobs at risk as part of a “strategic change”.

As of March, 2021, the cyber incident is believed to have cost £1.2 million. Sepa has written off around £2 million "that it will be unable to collect in fees due to loss of underlying records".

The auditor general was asked how criminals were able to gain access to Sepa’s systems.

READ MORE: Sepa chief executive Terry A’Hearn quits after 'conduct allegations'

He told the committee that Sepa “had good cyber security arrangements in place” but warned that “no organisation can fully mitigate against the risk of a cyber attack”.

Mr Boyle said that “the route into Sepa’s systems was through a phishing incident or phishing attack”, which he explained was “an email masquerading as a genuine email”.

He added that a staff member was conned into clicking on a link which “sets out a chain of events”.

Mr Boyle said: “There’s likely to have been an element of human error that has allowed the route in to Sepa’s systems.

“No matter how much preparation is done these events do happen, even in well prepared organisations with high levels of maturity.”