OT incident history · 54 incidents · 2008 to 2026
OT incident map
Cyber incidents that hit, disrupted or targeted operational technology, from the early Sandworm years to today. Pick a continent or an incident on the map, or search the list.
- Effect on operations
- Process impact (12)
- Operational disruption (33)
- Intrusion or foiled attack (9)
-
Malware in air navigation OT
South Africa's air navigation service provider ATNS investigated ransomware-linked malware in OT environments supporting weather services at Port Elizabeth and possibly other airports, with signs of data sent abroad. No flight disruption was reported.
Attribution, lesson for asset owners, sources
- Attribution
- Unknown
Lesson for asset owners: Supporting systems such as weather feeds are part of safety-critical operations. Include them in OT monitoring.
-
PLC attacks on US water systems
Attackers changed passwords and IP settings on internet-facing PLCs and HMIs at more than 30 Minnesota water systems, cutting monitoring and control and forcing some to manual operation. Utilities in at least 12 states reported similar incidents within weeks; water quality in Minnesota was not affected.
Attribution, lesson for asset owners, sources
- Attribution
- Suspected CyberAv3ngers (Iran-linked), per US officials quoted in media; not formally attributed
Lesson for asset owners: Three years after Aliquippa, exposed PLCs were still the way in. Remove direct internet exposure.
-
Small UK power generator shut for four days
According to the Sunday Telegraph, a cyberattack shut down a small-scale power generator for four days while staff restored it. The UK government said there was no risk to the wider energy system.
Attribution, lesson for asset owners, sources
- Attribution
- Iran-linked hackers, according to press reports; no formal attribution
Lesson for asset owners: Small generators connect to the same grid. Baseline security applies regardless of size.
-
Mackay Sugar mills
Ransomware took down the systems that coordinate cane supply, harvesting and mill intake during the crushing season. Mills stopped accepting cane; one restarted limited manual crushing two days later.
Attribution, lesson for asset owners, sources
- Attribution
- The Gentlemen ransomware (claimed)
Lesson for asset owners: Seasonal operations have no slack. Test the manual fallback before the season starts.
-
Destructive attack on Polish energy sites
Coordinated attacks hit more than 30 wind and solar farms, a large combined heat and power plant serving almost half a million customers, and a manufacturer. At the farms the attackers damaged RTU firmware and wiped HMIs, cutting remote control by the grid operator while generation continued. At the CHP plant EDR blocked the wiper.
Attribution, lesson for asset owners, sources
- Attribution
- Russia-linked: CERT Polska saw overlap with the Berserk Bear / Static Tundra cluster; ESET attributed it to Sandworm with medium confidence
Lesson for asset owners: Distributed renewable sites are now targets for destructive attacks. Harden remote access and keep firmware recovery images for RTUs and relays.
-
Ransomware at PDVSA
A ransomware attack and the clean-up that followed took down the state oil company's administrative systems. A company source told Reuters cargo deliveries had stopped, while PDVSA said production and exports were not affected.
Attribution, lesson for asset owners, sources
- Attribution
- Unknown; PDVSA blamed foreign interests
Lesson for asset owners: Clean-up can be as disruptive as the attack. Prepare an isolation plan that keeps operations running.
-
Asahi breweries halted
Ransomware took down order and shipping systems at Asahi Group, forcing its breweries in Japan to stop or cut production and causing shortages of its beer. Orders were handled manually for weeks.
Attribution, lesson for asset owners, sources
- Attribution
- Qilin ransomware (claimed)
Lesson for asset owners: Production stops when orders and logistics stop. Treat those IT systems as part of the operational chain.
-
Airport check-in systems down across Europe
Ransomware hit Collins Aerospace's MUSE shared check-in and boarding system. Brussels, Heathrow, Berlin and other airports fell back to manual check-in for days, and Brussels Airport cancelled many flights.
Attribution, lesson for asset owners, sources
- Attribution
- Ransomware, confirmed by ENISA; no group named
Lesson for asset owners: Shared platforms concentrate risk. Map which operational processes depend on a single supplier.
-
Jaguar Land Rover production stop
A cyberattack forced JLR to shut down its systems and halt vehicle production for about five weeks. The Cyber Monitoring Centre estimated the cost to the UK economy at around 1.9 billion pounds, affecting more than 5,000 organisations in the supply chain.
Attribution, lesson for asset owners, sources
- Attribution
- Scattered Lapsus$ Hunters (claimed)
Lesson for asset owners: Just-in-time supply chains multiply the impact of one plant's downtime. Include suppliers in continuity planning.
-
Hydropower plant in Tczew
Hacktivists published video of access to the control system of a small hydropower plant, first in May 2025 and again in August. Polish analysts concluded from turbine data that the second intrusion disrupted operations.
Attribution, lesson for asset owners, sources
- Attribution
- Russian hacktivists (claimed, with video)
Lesson for asset owners: After a first intrusion, assume the attacker will be back. Close the path, do not just reset the password.
-
Dam outlet opened at Bremanger
Attackers accessed the control system of a dam at Lake Risevatnet and opened an outlet, releasing about 500 litres per second for four hours before it was noticed. No one was hurt.
Attribution, lesson for asset owners, sources
- Attribution
- Pro-Russian hackers, per Norway's Police Security Service (August 2025)
Lesson for asset owners: Four hours without noticing is the real finding. Alarm on unexpected changes in actuator positions.
-
Varta battery plants halted
A cyberattack forced battery maker Varta to shut down its IT systems as a precaution, halting production at its five plants and administration for weeks.
Attribution, lesson for asset owners, sources
- Attribution
- Unknown
Lesson for asset owners: A precautionary shutdown is only short if restore procedures for production systems are tested.
-
Water tank overflow in Muleshoe
Attackers manipulated the internet-facing HMI of a small town's water system, causing a storage tank to overflow for 30 to 45 minutes until operators switched to manual. Nearby towns reported intrusion attempts in the same days.
Attribution, lesson for asset owners, sources
- Attribution
- Cyber Army of Russia Reborn (claimed); linked to Sandworm by Mandiant; two members sanctioned by the US Treasury
Lesson for asset owners: An HMI on the internet is a control panel for anyone. Put remote access behind a VPN with MFA.
-
FrostyGoop cuts heating in Lviv
Malware sent Modbus TCP commands to heating controllers of a municipal district heating company, leaving more than 600 apartment buildings without heating for almost two days in sub-zero temperatures. Dragos disclosed the case in July 2024.
Attribution, lesson for asset owners, sources
- Attribution
- Unknown (disclosed by Dragos)
Lesson for asset owners: Modbus has no authentication. Do not expose it, and filter and monitor which hosts may send write commands.
-
Water cut off in Erris
Attackers compromised an Israeli-made Unitronics PLC at a pumping station of a local water scheme, leaving about 180 homes without water for two days.
Attribution, lesson for asset owners, sources
- Attribution
- Pro-Iranian hacktivists, in line with the CyberAv3ngers campaign
Lesson for asset owners: Small operators are hit by the same mass campaigns as large ones. Basic hygiene closes most of the door.
-
Unitronics PLC at Aliquippa water authority
The group took over an internet-exposed Unitronics PLC at a booster station that controls water pressure and defaced its screen. The station was run manually; water supply was not at risk. The same group hit Unitronics PLCs in several countries using the default password.
Attribution, lesson for asset owners, sources
- Attribution
- CyberAv3ngers, linked to Iran's IRGC by the US government
Lesson for asset owners: Change default passwords and never put a PLC directly on the internet.
-
DP World Australia ports
A cyber incident forced DP World Australia to disconnect its systems from the internet, stopping trucks from collecting or delivering containers at four major terminals for about three days. A backlog of tens of thousands of containers followed.
Attribution, lesson for asset owners, sources
- Attribution
- Unknown
Lesson for asset owners: Disconnecting is a valid containment choice; know in advance what still works when you do.
-
LockBit at the Port of Nagoya
Ransomware hit the terminal operating system of Japan's busiest port by cargo volume, halting container handling for about two and a half days.
Attribution, lesson for asset owners, sources
- Attribution
- LockBit (claimed)
Lesson for asset owners: A single shared terminal system can stop a whole port. Design for redundancy and fast restore.
-
Volt Typhoon pre-positioning
Microsoft and Five Eyes agencies disclosed that Volt Typhoon had compromised critical infrastructure in Guam and the US, including communications, energy, water and transport. In 2024 CISA assessed the goal as pre-positioning for disruptive attacks, with some access lasting at least five years.
Attribution, lesson for asset owners, sources
- Attribution
- Volt Typhoon (China state-sponsored), per the US and allied governments
Lesson for asset owners: Living-off-the-land intrusions leave few traces. Baseline normal behaviour in OT networks so deviations stand out.
-
22 Danish energy companies breached
Attackers exploited a critical vulnerability in Zyxel firewalls to compromise 22 Danish energy companies in a coordinated campaign. Several companies switched to island mode, cutting their connection to the internet. SektorCERT called it the largest attack on Danish critical infrastructure so far.
Attribution, lesson for asset owners, sources
- Attribution
- Unknown; SektorCERT saw some indicators linked to Sandworm
Lesson for asset owners: A sector CERT with sensors across members saw the pattern fast. Shared monitoring pays off for small operators.
-
Sandworm trips breakers via MicroSCADA
Using living-off-the-land techniques, the attackers ran commands through a substation's MicroSCADA system to open breakers, causing an outage that coincided with Russian missile strikes. Two days later they deployed a wiper. Mandiant disclosed the case in November 2023.
Attribution, lesson for asset owners, sources
- Attribution
- Sandworm, per Mandiant
Lesson for asset owners: Attackers increasingly use the vendor's own tools. Watch for unusual use of legitimate engineering functions.
-
Fire at Khuzestan Steel
The group attacked three Iranian steel makers and released CCTV footage of a machine spilling molten steel and starting a fire at Khuzestan Steel. The group said it had acted with care to avoid harming people.
Attribution, lesson for asset owners, sources
- Attribution
- Predatory Sparrow (claimed)
Lesson for asset owners: Process safety and cyber security meet here. Hazard analyses (HAZOP, LOPA) should include deliberate manipulation.
-
Industroyer2 stopped before execution
Sandworm planned to switch off high-voltage substations of a Ukrainian energy company using Industroyer2, which speaks IEC 60870-5-104, and then wipe systems. CERT-UA and ESET detected and stopped the attack before it ran.
Attribution, lesson for asset owners, sources
- Attribution
- Sandworm, per CERT-UA and ESET
Lesson for asset owners: Detection and response capacity inside OT can stop even a prepared state attack.
-
KA-SAT outage cuts wind turbine monitoring
An hour before the invasion of Ukraine, an attack on Viasat's KA-SAT network disabled tens of thousands of satellite modems. As collateral damage, Enercon lost remote monitoring and control of about 5,800 wind turbines (11 GW) in Germany; the turbines kept generating.
Attribution, lesson for asset owners, sources
- Attribution
- Russia, per the EU, UK and US
Lesson for asset owners: Know which third-party communication links your OT depends on (satellite, cellular) and plan for their loss.
-
Oil terminals in Germany, Belgium and the Netherlands
Ransomware hit fuel suppliers Oiltanking and Mabanaft in Germany and, within days, terminal operators SEA-Invest and Evos in Belgium and the Netherlands. Loading and unloading at tank terminals slowed, delaying barges in the Amsterdam-Rotterdam-Antwerp hub.
Attribution, lesson for asset owners, sources
- Attribution
- Unknown; BlackCat ransomware was reported at Oiltanking
Lesson for asset owners: Terminal automation and planning are interlinked across companies. Share indicators quickly within the sector.
-
Iran's fuel stations go dark
A cyberattack disabled the subsidised fuel card system at about 4,300 petrol stations across Iran for days, while digital billboards showed messages aimed at the Supreme Leader. A similar attack in December 2023 hit about 70 percent of stations.
Attribution, lesson for asset owners, sources
- Attribution
- Predatory Sparrow (claimed)
Lesson for asset owners: Central payment and allocation systems can halt distributed physical operations. Plan a degraded mode.
-
Transnet port terminals
An attack on state logistics company Transnet disrupted the container terminal systems at Durban, Ngqura, Port Elizabeth and Cape Town. Transnet declared force majeure and moved to manual processes for more than a week.
Attribution, lesson for asset owners, sources
- Attribution
- Unknown ransomware operators
Lesson for asset owners: Terminal operating systems are a single point of failure. Rehearse manual fallback procedures.
-
Wiper attack on Iran's railways
A wiper attack on the national railway disrupted train services, and departure boards told passengers to call the office of the Supreme Leader. Researchers named the wiper Meteor.
Attribution, lesson for asset owners, sources
- Attribution
- Predatory Sparrow / Indra (claimed)
Lesson for asset owners: Passenger information and scheduling are part of rail operations. Keep tested offline backups for them.
-
REvil ransomware at JBS
Ransomware forced the world's largest meat processor to stop beef plants in the US and disrupted operations in Canada and Australia. JBS paid a ransom of 11 million US dollars.
Attribution, lesson for asset owners, sources
- Attribution
- REvil, per the FBI
Lesson for asset owners: Food production is critical infrastructure. Recovery plans must cover plant systems, not only office IT.
-
Colonial Pipeline
Ransomware hit Colonial Pipeline's IT network through a VPN account without multi-factor authentication. As a precaution the company shut down the 8,850 km fuel pipeline for about five days, causing shortages on the US East Coast. OT itself was not encrypted.
Attribution, lesson for asset owners, sources
- Attribution
- DarkSide ransomware group, per the FBI
Lesson for asset owners: Business dependencies such as billing can stop OT that was never touched. Use MFA on every remote access path.
-
Oldsmar water treatment
Officials said someone used remote desktop software to raise the sodium hydroxide setpoint from 100 to 11,100 ppm, which an operator reversed at once. In 2023 the former city manager said the FBI had concluded it was most likely an employee error. Either way, a shared password, no firewall and an unsupported operating system were found.
Attribution, lesson for asset owners, sources
- Attribution
- Disputed: first reported as a remote intruder; the former city manager said in 2023 it was most likely employee error
Lesson for asset owners: Remote access tools on HMIs and shared credentials are a risk whatever the cause. Log enough to tell an attack from a mistake.
-
Mumbai power outage
A major outage stopped suburban trains and much of the city for several hours. Recorded Future later reported the China-linked group RedEcho in Indian grid networks, but no link to this outage was proven.
Attribution, lesson for asset owners, sources
- Attribution
- Disputed: state officials suspected sabotage; India's power minister cited human error
Lesson for asset owners: Pre-positioning is a risk even without proven impact. Hunt for it in grid networks.
-
EKANS ransomware at Honda
Ransomware, widely reported as EKANS, hit Honda's internal network and halted production at plants in the US, Turkey, India and Brazil. EKANS stops a list of ICS-related processes, such as historian and licence services, before encrypting.
Attribution, lesson for asset owners, sources
- Attribution
- Operators of EKANS (Snake) ransomware
Lesson for asset owners: Plants depend on central IT services. Know which ones your production cannot run without.
-
Shahid Rajaee port disruption
A cyberattack on the computer systems that coordinate ship and truck traffic at Iran's main container port caused days of congestion. Reports linked it to retaliation for the attempted attack on Israeli water systems two weeks earlier.
Attribution, lesson for asset owners, sources
- Attribution
- Israel, according to officials quoted by The Washington Post
Lesson for asset owners: Logistics systems are part of the operational chain. A port stops when scheduling stops, even if cranes still work.
-
Attempt to alter chlorine at Israeli water plants
Attackers accessed control systems at several water and wastewater facilities. Media reports said they tried to change chlorine dosing; Israeli authorities said the attempts were stopped without impact on the water supply.
Attribution, lesson for asset owners, sources
- Attribution
- Iran, according to Israeli and Western officials quoted in media
Lesson for asset owners: Limit setpoint ranges in the controller itself, so a remote user cannot push a dose to a dangerous value.
-
Ransomware stops a gas pipeline
Ransomware entered a natural gas compression facility through spear-phishing and spread from IT into OT, encrypting HMIs, historians and polling servers. The operator shut the facility and, because of dependencies, the entire pipeline for about two days. Its emergency plan had no cyber scenarios.
Attribution, lesson for asset owners, sources
- Attribution
- Unknown ransomware operators
Lesson for asset owners: Add cyber scenarios to emergency response plans and map IT and OT dependencies between sites.
-
Malware at Kudankulam nuclear plant
India's nuclear operator NPCIL confirmed that Dtrack malware was found on a PC in the plant's administrative network. The plant control systems were isolated and not affected.
Attribution, lesson for asset owners, sources
- Attribution
- Lazarus Group (North Korea), according to security researchers
Lesson for asset owners: Isolation of control networks from administrative IT is what turned this into a non-event.
-
LockerGoga at Norsk Hydro
Ransomware encrypted Norsk Hydro's IT systems worldwide. Several extrusion plants switched to manual operation while smelters kept running. Hydro refused to pay and was praised for its open communication; the cost ran to hundreds of millions of Norwegian kroner.
Attribution, lesson for asset owners, sources
- Attribution
- LockerGoga ransomware operators
Lesson for asset owners: Practised manual operation and transparent crisis communication kept the business going.
-
Firewall reboots blind a renewables operator
Attackers exploited a known flaw in Cisco firewalls at renewable energy company sPower, making them reboot repeatedly for about ten hours. The control centre lost contact with wind and solar sites for minutes at a time, while generation continued. It was the first reported cyber event to disrupt US grid operations.
Attribution, lesson for asset owners, sources
- Attribution
- Unknown
Lesson for asset owners: Boundary devices are the doors to OT. Patch them first.
-
WannaCry variant stops TSMC fabs
A WannaCry variant entered TSMC's chip fabs when a new tool was installed without a malware scan. Several fabs in Taiwan were disrupted for days and TSMC put the cost at around 3 percent of quarterly revenue.
Attribution, lesson for asset owners, sources
- Attribution
- None: accidental infection
Lesson for asset owners: New equipment and service laptops are an attack path. Scan and quarantine before anything joins the production network.
-
Russian access to US energy control rooms
DHS and the FBI warned that Russian government actors had entered networks of energy and other critical infrastructure companies, reaching control-room workstations and collecting information about ICS. Trusted third parties and spear-phishing were the main way in.
Attribution, lesson for asset owners, sources
- Attribution
- Russian government (Dragonfly 2.0), per DHS and FBI
Lesson for asset owners: Supplier and integrator access is a common path into OT. Limit it, log it and review it.
-
TRITON safety system attack
Attackers reached the Triconex safety instrumented system of a petrochemical plant and tried to reprogram its controllers. A flaw in their code tripped the plant to a safe shutdown, which exposed the intrusion. It was the first known attack on a system built to protect human life.
Attribution, lesson for asset owners, sources
- Attribution
- TEMP.Veles / XENOTIME; linked to Russia's CNIIHM institute, sanctioned by the US Treasury in 2020
Lesson for asset owners: Give the SIS its own zone, keep the key switch out of PROGRAM, and monitor every engineering connection to it.
-
NotPetya
Spread through a poisoned update of Ukrainian accounting software, NotPetya destroyed systems at companies worldwide. Maersk's container terminals came to a standstill, Merck and Mondelez lost production, and radiation monitoring at Chornobyl switched to manual.
Attribution, lesson for asset owners, sources
- Attribution
- Russian military (Sandworm), per the US, UK and other governments
Lesson for asset owners: A flat network lets a worm reach everything. Segmentation and offline backups decided how fast companies recovered.
-
WannaCry halts car plants
The WannaCry worm spread through the SMBv1 flaw EternalBlue to some 150 countries. Renault and Nissan stopped production at several plants, including Sandouville in France and Sunderland in the UK.
Attribution, lesson for asset owners, sources
- Attribution
- Lazarus Group (North Korea), per US and UK governments
Lesson for asset owners: Legacy Windows in production needs compensating controls when patching is not possible. Disable SMBv1, segment and monitor.
-
Industroyer at a Kyiv substation
Malware that spoke grid protocols (IEC 60870-5-101 and 104, IEC 61850, OPC DA) opened breakers at a transmission substation north of Kyiv, causing an outage of about an hour. It was the first known malware built specifically to attack power grids.
Attribution, lesson for asset owners, sources
- Attribution
- Sandworm (Russia's GRU), per US and UK governments
Lesson for asset owners: Industrial protocols without authentication accept any command. Detect unusual commands at protocol level, not only at the perimeter.
-
Heating controllers knocked offline by DDoS
A DDoS attack hit internet-connected building automation in at least two apartment blocks. The heating controllers kept restarting and stopped heating and hot water while outside temperatures were below freezing.
Attribution, lesson for asset owners, sources
- Attribution
- Unknown
Lesson for asset owners: Building automation is OT. Controllers should fail to a safe operating mode and should not be reachable directly from the internet.
-
Ukrainian power grid blackout
Attackers took over the SCADA systems of three regional distribution companies and opened breakers remotely, cutting power to about 225,000 customers for several hours. They also wiped systems, bricked serial-to-Ethernet gateways and flooded call centres.
Attribution, lesson for asset owners, sources
- Attribution
- Sandworm (Russia's GRU), per US and UK governments
Lesson for asset owners: The attackers used legitimate remote access and the operators' own HMI. Strong authentication and monitoring of remote sessions matter more than malware signatures.
-
German steel mill blast furnace
Germany's BSI reported that attackers used spear-phishing to reach a steel mill's office network and from there its production network. Control components failed so that a blast furnace could not be shut down in a controlled way, causing massive damage.
Attribution, lesson for asset owners, sources
- Attribution
- Unknown
Lesson for asset owners: Phishing into IT, then pivot to OT, is the classic route. Zone boundaries and a safe state that holds when controls fail limit the damage.
-
Havex trojanised ICS vendor software
The Dragonfly group replaced software installers on the websites of three ICS vendors, so energy and industrial customers installed a remote access trojan themselves. A Havex module scanned for OPC servers, mapping industrial networks in Europe and the US.
Attribution, lesson for asset owners, sources
- Attribution
- Dragonfly / Energetic Bear, linked to Russia
Lesson for asset owners: Verify vendor software (signatures, hashes) before it enters OT. The supply chain belongs in your zone and conduit model.
-
Bowman Avenue Dam
An intruder accessed the SCADA system of a small flood-control dam through a cellular modem and could read water levels and the status of the sluice gate. The gate had been disconnected for maintenance, so it could not be operated remotely.
Attribution, lesson for asset owners, sources
- Attribution
- An Iranian national, charged by the US Department of Justice in 2016
Lesson for asset owners: Small assets are reconnaissance targets too. Keep an inventory of every controller reachable over the internet or a cellular link.
-
Shamoon wiper at Saudi Aramco
The Shamoon wiper erased about 30,000 workstations at the world's largest oil company, forcing weeks of paper-based business processes. Production was reported unaffected; Qatar's RasGas was hit days later.
Attribution, lesson for asset owners, sources
- Attribution
- Iran, according to US officials; claimed by 'Cutting Sword of Justice'
Lesson for asset owners: Separation between IT and OT kept oil flowing. Plan how the plant keeps running while the office network is gone.
-
Stuxnet
Discovered in June 2010, Stuxnet reprogrammed Siemens S7 controllers at the Natanz uranium enrichment plant to vary centrifuge speeds while operators saw recorded normal values. Earlier versions were active from 2007. It is the first known cyberweapon to cause physical damage.
Attribution, lesson for asset owners, sources
- Attribution
- Widely attributed to the United States and Israel; never officially confirmed
Lesson for asset owners: An air gap is not a control on its own. Removable media and engineering workstations carried the attack in, and the HMI showed falsified values.
-
Baku-Tbilisi-Ceyhan pipeline explosion
An explosion and fire hit a valve station of the BTC oil pipeline days before the Russia-Georgia war. A 2014 report claimed attackers had raised the pressure and suppressed alarms through the network, but no technical evidence was published and later analyses doubt the cyber explanation.
Attribution, lesson for asset owners, sources
- Attribution
- Russia, according to unnamed US officials in a 2014 report; the PKK claimed the blast; Turkey cited a technical failure
Lesson for asset owners: Separate claims from evidence. Without logs and forensics nobody can prove what caused a process upset.
-
Łódź tram network
A teenager modified a TV remote control to switch the infrared-operated track points of the city's tram network. Four trams derailed and twelve people were injured.
Attribution, lesson for asset owners, sources
- Attribution
- A 14-year-old local student
Lesson for asset owners: Field control channels without authentication are attack surface too, even when nothing is connected to a network.
No incidents match. Try another search or continent.
Curated by OTASEC from public sources. Attribution is given as stated by governments, CERTs or named researchers; blips for undisclosed sites sit at the country centre, and nearby blips are spaced apart so each can be clicked.