Case studies
Incident library
What actually happened, how it was detected, where earlier detection was possible, and what to change as a result.
Each case study is written from public reporting and is deliberately defensive: attack paths are described at the level needed to build detection and controls, not to reproduce them.
2023 · Water / Wastewater
Unitronics PLC Targeting at Water Utilities
Internet-exposed programmable logic controllers at water utilities were accessed and defaced, with default credentials and direct internet reachability identified as the enabling conditions.
2022 · Multiple (energy, manufacturing)
PIPEDREAM / INCONTROLLER
A modular ICS attack toolkit discovered before deployment against a victim environment, capable of interacting with specific controller families and industrial protocols.
2021 · Oil & Gas (pipeline)
Colonial Pipeline Ransomware
A ransomware intrusion in the business environment led the operator to proactively halt pipeline operations. Public reporting does not describe direct compromise of pipeline control systems.
2021 · Water / Wastewater
Oldsmar Water Treatment Access Incident
Unauthorised remote access to a water treatment plant HMI was used to change a chemical setpoint. An operator observed the change and reverted it immediately; treated water was not affected.
2017 · Oil & Gas / Petrochemical
TRITON / TRISIS
Malware that targeted a safety instrumented system controller, attempting to modify safety logic. The intrusion was discovered when the safety system tripped the process to a safe state.
2017 · Multiple (shipping, pharmaceutical, manufacturing)
NotPetya
Destructive malware distributed through a compromised software update mechanism spread rapidly across enterprise networks worldwide, halting operations at manufacturers, logistics operators and pharmaceutical companies.
2016 · Electric Power
Industroyer / CrashOverride
Malware with modules implementing industrial telecontrol protocols directly, used in a 2016 transmission substation incident causing a brief outage in Kyiv. A later variant was reported in 2022 targeting Ukrainian energy infrastructure.
2015 · Electric Power
Ukraine 2015 Power Grid Incident
Coordinated intrusion at multiple distribution utilities resulted in remote operation of breakers, causing outages affecting roughly 225,000 customers, with recovery complicated by firmware and telephony disruption.
2010 (discovered) · Nuclear enrichment
Stuxnet
Malware that targeted specific Siemens control configurations and manipulated the process while presenting normal values to operators. Widely regarded as the first publicly analysed malware built to cause physical effects.