The Scottish Government’s green watchdog has lost £2.5 million income from industry permits and inspections following a debilitating cyber attack, according to documents obtained by The Ferret.

Ministerial briefings released under freedom of information law also revealed that the Scottish Environment Protection Agency (Sepa) was likely to suffer “significant reputational damage” as a result of the attack.

Officials said the impact on Sepa’s systems was “at the most serious end of the spectrum”. Sepa’s former boss described it as a “shambles” and a “failure of oversight”, while campaigners condemned the cyber criminals as “despicable”.

Sepa stressed that it was working to recover from a “complex and sophisticated” attack. It had commissioned an “independent audit” to learn lessons for the future.

The attack against Sepa’s computers was launched at one minute past midnight on Christmas Eve 2020, reportedly by an international criminal gang known as Conti. It demanded a large ransom, amount unknown, to restore access to Sepa’s data.

Sepa refused to pay, its communications were wrecked and over 4,000 stolen files stolen were published on the dark web. Up to April Sepa spent £800,000 responding to the attack, and it could take until 2023 to recover.