IT / OT Security News

CISA: Over 100 Internet-Exposed Water Systems Targeted in July Cyberattacks

The Cybersecurity and Infrastructure Security Agency (CISA) says it’s aware of 100 internet-exposed water systems targeted in cyberattacks in July.

Iran-Linked Hackers Shut Down UK Power Plant for Four Days

Iran-linked hackers reportedly managed to shut down a British power plant for four days in July 2026. The story was broken by the Telegraph newspaper on August 22, 2026. That it took so long to become public knowledge immediately says two things. Firstly, it was not a major power plant since the effect would have been immediately noticed, and secondly, the authorities wished to keep news of the attack as low key as possible.

Iranian hackers shut down UK power plant

Iran shut down a British power plant for four days in an unprecedented cyber attack, The Telegraph can disclose.

ISASecure and NSA develop HCSA certification scheme for high-criticality operational technology components

ISASecure, a wholly owned subsidiary of the International Society of Automation (ISA), is partnering with the U.S. National Security Agency (NSA) to develop a certification scheme for commercial operational technology (OT) components that manufacturers sell and the U.S. government procures for use in National Security Systems (NSS).

Hackers Using AI to Target Siemens PLCs in Critical US Sectors

Several government agencies in the United States have issued a joint cybersecurity advisory warning critical infrastructure organizations about hacker attacks targeting Siemens programmable logic controllers (PLCs).

Threat Actor Hacks 14,000 IP Cameras in Ukraine and Russia

A threat actor has conducted a mass-hacking campaign against Dahua IP cameras, compromising over 14,000 of them across Ukraine and Russia, Hunt.io reports.

US warns Siemens devices can be hacked amid fears Iran is breaching water plants

Several U.S. government agencies warned that unidentified hackers are trying to breach devices made by Siemens ​that are used to monitor and operate water facilities and other ‌critical infrastructure systems, according to a cybersecurity advisory published on Wednesday.

Ransomware attack on Health Sciences Centre affects doors, ventilation and air conditioning

A ransomware attack on Winnipeg's Health Sciences Centre has affected door access, heating, ventilation and air conditioning at Manitoba's largest hospital.

Hackers breached a small Polish energy plant via private APN last year

Hackers used a dedicated mobile gateway to compromise a second facility during the destructive cyberattacks that hit Poland's energy sector last year.

Novel Private APN Pivot Let Hackers Sabotage Second Polish Energy Facility

Poland’s computer emergency response team (CERT) has published a report detailing a second attack on the country’s power grid. The attackers targeted industrial control systems (ICS) and their objective was “purely destructive”.

Cyber intrusion targets Childersburg Water, Sewer, and Gas system

The Childersburg Water, Sewer, and Gas Board reported that its computerized monitoring and control network was targeted in a cyberattack late last month, prompting officials to temporarily disconnect the system while additional safeguards are put in place.

Hackers grow more willing to destroy, not just disrupt, OT systems

Cyberattacks on operational technology have shifted in recent years from extortion and espionage to destruction, a trend that should alarm those tasked with defending outdated industrial equipment, experts said on Thursday.

At least 12 states report cyberattacks on water systems possibly linked to Iran-backed hackers, sources say

Cyberattacks on U.S. water systems that officials suspect may be linked to Iran-backed hackers have been reported in at least a dozen states, sources familiar with the matter told CBS News on Wednesday.

NC Ports operating manually after cyberattack disrupts statewide systems

Normal gate schedules resumed Thursday, Aug. 6, at North Carolina ports, but operations are still being processed manually following an Aug. 4 cyberattack that disrupted systems statewide.

US water facilities targeted by ‘malicious cyber actors’ – who’s to blame?

Late last week, federal authorities issued a stern warning saying “malicious cyber actors” were targeting water and wastewater facilities in at least seven states across the US. Minnesota appeared to be the hardest hit with 30 of its water systems hit by cyber-attacks, leading to disruptions in the state’s water supply.

Decades-Old BMC Vulnerability Exposes Thousands of Data Centers to Attacks

Thousands of data centers are at risk of compromise due to a 22-year-old vulnerability in Baseboard Management Controller (BMC) management processors, data center security firm Lava reports.

Russian State APT Linked to Recent Public Wi-Fi Gateway Hacking

A Russian state-sponsored APT is behind a recent credential theft campaign mounted via hacked public Wi-Fi gateway appliances at organizations running captive portal networks, Microsoft reports.

US Water Cyberattacks Extend Beyond Minnesota to at Least 6 Other States

The recent cyber campaign targeting the water and wastewater sector in the United States has hit at least seven states as more information has come to light regarding Iran’s connection to the hacker attacks.

1 in 5 Data Center Assets Are Within Easy Reach of Attackers

Nearly one in five of the cyber-physical systems (CPS) that keep the world’s largest data centers running sits just a single network connection away from pathways that could let attackers reach them, according to new research from Claroty.

Claroty’s Team82 reveals widespread CPS exposures across data center infrastructure, calls for zero trust measures

New research from cyber-physical systems (CPS) protection vendor Claroty’s Team82 threat research group warns that CPS (cyber-physical systems) supporting modern data centers face widespread and highly accessible security exposures.

Dozens of Minnesota Water Utilities Targeted in Coordinated OT Attacks

State and federal agencies are conducting an investigation after a coordinated cyberattack hit operational technology (OT) systems at dozens of water utilities in Minnesota.

US, Australia Release OT Isolation Guidance for Critical Infrastructure

The US cybersecurity agency CISA and Australia’s Cyber Security Centre (ACSC) have published joint guidance detailing how critical infrastructure (CI) organizations can isolate vital OT and supporting systems.

Minnesota IT officials disclose 'coordinated cyberattack' at more than 30 local water systems

A "coordinated cyberattack" targeted more than 30 ‌community water systems in the U.S. state of Minnesota on July 26 and July 27, the state's IT agency said in a statement.

Hacked Public Wi-Fi Gateways Used to Harvest Corporate Credentials

A threat actor has been hacking public Wi-Fi gateway appliances at organizations running captive portal networks to compromise the Microsoft 365 accounts of traveling corporate employees, ReliaQuest reports.

US Warns of Iranian Hackers Targeting Siemens, Schneider, and Rockwell ICS Devices

The US government has updated a recent cybersecurity advisory describing Iran-linked attacks on critical infrastructure organizations, warning that hackers have been targeting industrial control systems (ICS) made by Siemens, Schneider Electric, and Rockwell Automation.

Hacker group RansomHouse claims responsibility for cyberattack on Nichirei

A hacker group calling itself RansomHouse has claimed responsibility for a cyberattack last week that disrupted operations at Japanese frozen-food and logistics company Nichirei, affecting restaurants, supermarkets and school lunch programs.

Russian cyber espionage campaign exploits insecure IP cameras in Europe and Ukraine, Dutch agencies say

Dutch intelligence agencies warned that Russian state actors are systematically compromising internet-connected IP cameras across the Netherlands, other EU and NATO member states, and Ukraine to support cyber espionage, exposing organizations with vulnerable surveillance systems to intelligence-gathering operations.

Legacy Systems, Real-World Impacts: The Reality of OT Security

At DEF CON, the ICS Village is one of the more popular places to hang out. It works well for folks who are either new to the field of infosec and cybersecurity, or old-hands in the industry, for the same reason: once you get close enough to a piece of OT technology with your modern IT vulnerability-hunting tooling and instincts, it often feels like you’re hacking like it’s 1999, all over again.

ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Rockwell

Industrial giants Siemens, Schneider Electric, and Rockwell Automation have published July 2026 Patch Tuesday advisories to inform customers about vulnerabilities found in their ICS products.

New Controller Flaws Expose Highway Signs and Billboards to Remote Hacking

Critical and high-severity vulnerabilities in some Daktronics controllers could allow hackers to tamper with highway signs and billboards, according to the cybersecurity researcher who discovered the flaws.

NIST SP 1800-45 outlines remote access security as key priority for water, wastewater sector amid expanding OT cyber risks

The U.S. National Institute of Standards and Technology (NIST) is urging water and wastewater utilities to strengthen cybersecurity as the sector’s growing digital transformation expands exposure to cyber risk.

First-Ever Exploitation of PTC Windchill Vulnerability Discovered in the Wild

Threat actors have successfully exploited a vulnerability in PTC Windchill in the wild, marking the first confirmed real-world abuse of the popular product lifecycle management (PLM) platform.

Lantronix Serial-to-IP Converter Flaw Exploited in Attacks After OT Threat Warning

A vulnerability that can facilitate attacks on operational technology (OT) systems is being exploited in the wild, according to the cybersecurity agency CISA.

Rockwell Automation Patches Vulnerabilities in ICS Controllers and Software

Rockwell Automation informed customers on Tuesday that patches are available for several vulnerabilities affecting its Logix and CompactLogix controllers, Flex I/O dual-port Ethernet/IP adapters, RSLinx industrial communication software, and FactoryTalk automation suite.

Iran-linked Handala group targets Cal Water, exposing potential pathways between IT and OT environments

Dataminr disclosed that an Iran-linked threat group known as Handala has claimed responsibility for breaching systems belonging to California Water Service (Cal Water), one of the largest water utilities in the U.S., serving approximately two million customers across California.

Iranian Cyber Group Handala Claims Cal Water Hack

The Iran-linked threat actor Handala this week boasted to have hacked California Water Service (Cal Water), and published 5 gigabytes of data allegedly stolen from the US water utility.

Cyberattack disrupts Mackay Sugar operations, exposing growing agri-industrial cyber risks

A cyberattack has disrupted operations at Mackay Sugar, Australia’s second-largest raw sugar producer, forcing the shutdown of its Farleigh and Racecourse mills in Queensland and bringing harvesting operations to a standstill.

Critical HVAC and UPS Vulnerabilities Could Let Hackers Disrupt Data Centers

Researchers at cyber-physical systems security firm Claroty have uncovered multiple vulnerabilities in two widely deployed HVAC and UPS products used in data centers, demonstrating how attackers could exploit them to launch disruptive remote attacks.

ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Phoenix Contact

ICS Patch Tuesday advisories were published this month by Siemens, Schneider Electric, and Phoenix Contact.

The War Between Wars: How an IRGC Cyber Front Runs Destructive OT and IT Attacks Under Cover of a Ceasefire

On a May afternoon, refrigeration engineers were called to a food-production plant. The cold rooms and freezers were warming up, and the product inside them was fresh. The engineers expected what they usually find: a failed compressor, a leaking valve, a tripped protection. They arrived ready to fix a machine.

Real-World ICS Security Tales From the Trenches

Industrial control systems (ICS) and operational technology (OT) environments are often described as quiet, highly controlled worlds. In reality, they contain a range of risks, unexpected configurations, and operational complexities that are difficult to fully uncover through standard penetration testing or conventional risk assessments.

Critical Vulnerability Exposes Industrial Robot Fleets to Hacking

Universal Robots, a Danish company specializing in collaborative industrial robots, or cobots, has patched a critical vulnerability affecting one of its operating systems.

State-backed ransomware activity raises new concerns over escalating threats to OT, critical infrastructure operations

Ransomware groups are increasingly being used as proxy weapons in geopolitical cyber warfare, enabling nation-states to exert pressure on their adversaries while maintaining plausible deniability.

ICS Patch Tuesday: New Security Advisories From Siemens, Schneider, CISA

Only Siemens, Schneider Electric, CISA, and CERT@VDE have published new ICS security advisories for the May 2026 Patch Tuesday.

Polish Security Agency Reports ICS Breaches at Five Water Treatment Plants

Poland’s Internal Security Agency (ABW) has documented a significant escalation in cyberattacks targeting industrial control systems (ICS) and other operational technology (OT) infrastructure during 2024 and 2025, with state-sponsored threat actors increasingly shifting focus toward the physical disruption of critical services.

Claude AI Guided Hackers Toward OT Assets During Water Utility Intrusion

Cybersecurity firm Dragos has released a threat intelligence report detailing an intrusion into a municipal water and drainage utility in Monterrey, Mexico, in which an unidentified threat actor made extensive use of AI tools to assist its operation.

EnOcean SmartServer Flaws Expose Buildings to Remote Hacking

Vulnerabilities discovered by Claroty researchers in EnOcean’s SmartServer IoT platform can be exploited to remotely hack building management systems.

Hundreds of Internet-Facing VNC Servers Expose ICS/OT

Millions of remote access RDP and VNC servers are exposed to the internet, and hundreds of them may provide access to industrial control systems (ICS) and other operational technology (OT), according to research by Forescout.

Electric Motorcycles and Scooters Face Hacking Risks to Security and Rider Safety

Vulnerabilities in Zero Motorcycles electric motorcycles and Yadea electric scooters can pose physical security and safety risks.

Serial-to-IP Devices Hide Thousands of Old & New Bugs

The OT devices that translate machine talk into Internet-speak are riddled with vulnerabilities and more frequently targeted for attacks, researchers say

Serial-to-IP Converter Flaws Expose OT and Healthcare Systems to Hacking

Forescout researchers discovered 20 new vulnerabilities in Lantronix and Silex products and described theoretical attack scenarios.

ZionSiphon malware designed to sabotage water treatment systems

A new malware called ZionSiphon, specifically designed for operational technology, is targeting water treatment and desalination environments to sabotage their operations.

$10 Domain Could Have Handed Hackers 25k Endpoints, Including in OT and Gov Networks

The scale of infection among high-value targets proved particularly concerning. Of the hosts observed, 324 belonged to sensitive networks, including 221 universities and colleges, 41 operational technology (OT) networks, 35 government entities, and three healthcare organizations.

Industry Reactions to Iran Hacking ICS in Critical Infrastructure: Feedback Friday

The US government has warned that Iran-linked hackers are manipulating PLCs and SCADA systems to cause disruption.

Iranian Threat Actors Disrupt US Critical Infrastructure Via Exposed PLCs

Iran-affiliated threat actors are disrupting US critical infrastructure through attacks on Internet-exposed operational technology (OT) devices across numerous sectors, the US government is warning.

Russian Hackers Exploiting Home and Small-office Routers in Massive DNS hijacking Attack

A large-scale campaign by Forest Blizzard, a Russian military-linked threat actor, targeting home and small-office routers to hijack DNS traffic and intercept encrypted communications with over 200 organizations and 5,000 consumer devices already compromised.

Iran-Linked Hackers Disrupt US Critical Infrastructure via PLC Attacks

Several critical infrastructure organizations in the US were disrupted by Iran-linked cyberattacks that impacted operational technology (OT) devices, according to an urgent warning from federal agencies on Tuesday.

How Iranian hackers pose a threat to US critical infrastructure

Michigan may be more than 6,000 miles away from the war in Iran, but, virtually speaking, it’s well within striking distance.

Water treatment plant in North Dakota suffered ransomware attack

A ransomware attack last month forced operators of a water treatment facility in Minot, North Dakota, to revert to manual processes while a back-up server could be located.

Team Cymru warns exposed ICS and OT devices targeted by nation-state actors raise industrial, critical infrastructure risks

Following last month’s post highlighting its capabilities for protecting ICS (industrial control systems) and OT (operational technology) environments, Team Cymru published new research examining three case studies that reveal the extent of exposed ICS and OT devices known to be targeted by hostile nation-state actors. The findings underscore a critical concern: many of these systems remain directly exposed and vulnerable to exploitation.

Iran Built a Vast Camera Network to Control Dissent. Israel Turned It Into a Targeting Tool

The role of Israel’s hijacking of Iran’s street cameras in the killing of the country’s supreme leader underscores how surveillance systems are increasingly being targeted by adversaries in wartime.

Poland Faced a Surge in Cyberattacks in 2025, Including a Major Assault on the Energy Sector

The attacks included a destructive infiltration of Poland’s energy system in December and was suspected of originating in Russia.

Hacking Attempt Reported at Poland’s Nuclear Research Center

Poland’s national nuclear research center was recently targeted in a cyberattack that may have been conducted by Iranian hackers.

ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Moxa, Mitsubishi Electric

Industrial giants Siemens, Schneider Electric, Mitsubishi Electric, and Moxa have published new ICS Patch Tuesday advisories.

Rockwell Vulnerability Allowing Remote ICS Hacking Exploited in Attacks

CISA added the flaw, tracked as CVE-2021-22681, to its Known Exploited Vulnerabilities (KEV) catalog on Thursday, instructing federal agencies to address it by March 26.

State-affiliated hackers set up for critical OT attacks that operators may not detect

Threat groups are weaponizing industrial control access they’ve gained over the years, but critical infrastructure operators remain unprepared for what comes next, research from Dragos suggests.

APT37 hackers use new malware to breach air-gapped networks

North Korean hackers are deploying newly uncovered tools to move data between internet-connected and air-gapped systems, spread via removable drives, and conduct covert surveillance.

3 Threat Groups Started Targeting ICS/OT in 2025: Dragos

Three new threat groups started targeting industrial control systems (ICS) and other operational technology (OT) in 2025, according to a new report from cybersecurity company Dragos.

Cyber Insights 2026: The Ongoing Fight to Secure Industrial Control Systems

The cybersecurity challenge for Industrial Control Systems (ICS) is they were designed in conditions of peace but now operate in a continuous war zone.

CISA issues new OT security guidance to overcome cost and complexity barriers in critical infrastructure

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) released new guidance aimed at closing long-standing gaps in OT (operational technology) security across critical infrastructure sectors, including water and wastewater, transportation, chemical, energy, and food and agriculture.

ICS Patch Tuesday: Vulnerabilities Addressed by Siemens, Schneider, Aveva, Phoenix Contact

Industrial giants Siemens, Schneider Electric, Aveva, and Phoenix Contact have published Patch Tuesday advisories informing customers about vulnerabilities found in their ICS/OT products.

Leaked technical documents show China rehearsing cyberattacks on neighbors’ critical infrastructure

China appears to be using a secret training platform to rehearse cyberattacks against the critical infrastructure of its closest neighbors, according to a cache of leaked technical documents reviewed by Recorded Future News.

Default ICS Credentials Exploited in Destructive Attack on Polish Energy Facilities

Poland’s computer emergency response team (CERT) has published a report detailing the recent attack by Russia-linked hackers on the country’s power grid.

ICS Devices Bricked Following Russia-Linked Intrusion Into Polish Power Grid

The recent attack on Poland’s power grid, believed to have been conducted by Russian threat actors, targeted communication and control systems across roughly 30 sites and in some cases resulted in permanent industrial control system (ICS) damage, according to industrial cybersecurity firm Dragos.

Russian Sandworm Hackers Blamed for Cyberattack on Polish Power Grid

The Russian state-sponsored APT named Sandworm was behind the December 2025 cyberattack targeting Poland’s power grid, cybersecurity firm ESET reports.

Poland repels data-wiping malware attack on energy systems

According to information shared by the Polish government earlier this month, the attacks happened on 29 and 30 December 2025, and targeted two combined heat and power (CHP) plants and a system enabling the management of electricity generated from wind turbines and photovoltaic farms.

TP-Link Patches Vulnerability Exposing VIGI Cameras to Remote Hacking

TP-Link has patched a serious vulnerability that can be exploited to take control of more than 32 of its VIGI C and VIGI InSight series professional surveillance camera models.

Chinese hackers targeting ‘high value’ North American critical infrastructure, Cisco says

Chinese hackers successfully breached multiple critical infrastructure organizations in North America over the last year using a combination of compromised credentials and exploitable servers, researchers at Cisco Talos found.

ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Aveva, Phoenix Contact

Industrial giants Siemens, Schneider Electric, Phoenix Contact, and Aveva have published a dozen Patch Tuesday advisories to inform customers about vulnerabilities found in their ICS/OT products.

Massive cyberattack on Polish power system in December failed, minister says

Poland's power system faced its largest cyberattack in years in the last week of December that also followed a different pattern, the country's energy minister said on Tuesday.

Researchers Expose WHILL Wheelchair Safety Risks via Remote Hacking

Security researchers have demonstrated a critical vulnerability in high-tech electric wheelchairs that allows for unauthorized remote control, highlighting new safety risks for connected mobility devices.