When Critical Infrastructure Becomes the Target: The New Cybersecurity Battle for Utilities

When Critical Infrastructure Becomes the Target: The New Cybersecurity Battle for Utilities

The perimeter that used to define what a utility protected has effectively dissolved.

 

The pipeline that fell to a leaked password

A few years ago, one of the largest fuel-pipeline operators in the Northern Hemisphere shut down thousands of kilometres of pipeline overnight. Not because the attackers had reached the pipeline itself, but because the operator could no longer confidently bill customers for what flowed through it, and because the operational and business systems were interconnected enough that separating one from the other with confidence was no longer possible. Fuel prices spiked. Airlines rerouted. State governors declared emergencies. The national government invoked emergency production powers.

 

The actual breach point was almost embarrassingly ordinary. A single remote-access account, still active though not in daily use, secured only by a password with no multi-factor authentication, whose credentials had leaked in an earlier unrelated data set circulating on the dark web. A criminal ransomware crew used it. The operator paid a cryptocurrency ransom worth several million dollars within hours of the intrusion. Federal authorities later recovered about half of it.

I have spent 25 years across banking, financial services, government, and telecommunications, including time inside a Tier-1 national Security Operations Centre. This is the incident I return to most often when I want to explain why the cybersecurity conversation in every board room I sit in has irreversibly changed. It is not a story about a sophisticated adversary defeating sophisticated defences. It is a story about an ordinary attacker exploiting an ordinary weakness and, through the plumbing of a modern enterprise, causing a national economic event.

 

That is the shift. And it is happening across every critical-infrastructure sector, in every jurisdiction, at once.

 

What actually changed

For most of the last two decades, cybersecurity in critical infrastructure lived under an unspoken assumption: Information Technology and Operational Technology were separate worlds. Corporate email, ERP, CRM and web systems lived on IT networks. Programmable Logic Controllers, SCADA systems, distributed control systems, RTUs, safety-instrumented systems and the actual physical process control lived on OT networks. IT was the internet-facing surface where attackers played. OT was air-gapped, or as close to it as any real operator ever got, and its threats were measured in years, not weeks.

 

Three simultaneous changes broke that assumption.

 

First, IT/OT convergence became irresistible. Operators wanted real-time telemetry from the plant floor visible in the boardroom. Predictive maintenance required plant data pumped to cloud analytics. Remote engineers needed to configure PLCs during a pandemic without flying to substations. So the air gap became a firewall, then a jump host, then a VPN, then a cloud-connected historian, then a vendor-managed remote-access portal. Every step made the business case stronger and the security boundary weaker.

 

Second, the OT threat actors grew up. What used to be the domain of a handful of nation-state programmes has industrialised. Named threat groups tracked by CISA and its Five Eyes partners now include OT-specific playbooks. Recent joint advisories have publicly warned that state-sponsored actors from at least three named adversary nations are actively probing water, wastewater, dam, energy and food/agriculture sectors, with one prominent campaign explicitly pre-positioning access for potential activation during a future geopolitical crisis.

 

Third, the extended attack surface exploded. Every solar inverter, every smart meter, every remote-monitoring gateway on a wind farm, every fleet-management box on a delivery truck, every telco cell site providing backhaul to a substation, every cloud SaaS the utility uses for billing, every managed-service-provider engineer with remote access, every IoT sensor in a water treatment plant, every satellite terminal on an offshore platform, is now part of the critical-infrastructure attack surface. In many utilities I have looked at, the OT team no longer knows the full topology of what touches their environment, because the IT, cloud, telco and vendor teams each own a piece and no one owns the map.

 

The uncomfortable irony is that the industry has never had more sophisticated frameworks available. IEC 62443 zone-and-conduit design, the Purdue Enterprise Reference Architecture, NIST SP 800-82 Rev 3 for OT security, MITRE ATT&CK for ICS, MITRE D3FEND, NIST’s post-quantum cryptography standards (FIPS 203, 204, 205), confidential computing, SPIFFE workload identity, blockchain-based supply-chain provenance under SLSA and in-toto, SBOM standards under CycloneDX and SPDX, and OSCAL for machine-readable control assurance. Every one of these is real, useful, and being adopted. And yet the incidents that actually take utilities down almost always start with a forgotten VPN account, an unpatched remote-access tool, or a shared password on an operator workstation. We are spending on advanced defences while leaving the front door unlocked.

 

 

Why traditional security failed

A small water-treatment plant in a coastal town serving fewer than twenty thousand people had a plant operator watch, in real time, as an unknown attacker moved the mouse cursor across the SCADA console and dialled the sodium hydroxide dosage in the town’s drinking water up by a factor of one hundred. The operator reversed the change immediately. The underlying facts were sobering: the plant had a consumer remote-desktop tool installed on operator workstations, using shared passwords, exposed to the internet, on an unsupported operating system. That is not a small-town problem in one country. That is an economics-of-small-utilities problem, and every developed nation has thousands of small water utilities running similar stacks.

 

Elsewhere, a series of coordinated cyber-physical attacks against a national electricity distribution network in Eastern Europe demonstrated for the first time, publicly, that a well-resourced adversary could cause coordinated blackouts through cyber means alone. Two consecutive winters. The first attack cut power to hundreds of thousands of people for hours. The second was more surgical: it targeted a single transmission substation and demonstrated automated, protocol-aware manipulation of IEC 61850, IEC 60870-5-101, and IEC 60870-5-104. A follow-up campaign years later attempted the same technique against millions of consumers; it was detected and stopped, but only just.

 

Closer to home, over the last three years, several top-tier Australasian telecommunications, health-insurance and superannuation operators have experienced breaches that exposed the personal information of a substantial fraction of their national adult populations. In each case, the entry vector was mundane: an unauthenticated API endpoint, a compromised credential, an insufficiently scoped identity. None of these were critical infrastructure in the OT sense, but they illustrate the pattern that matters. A single access-control failure at a national-scale operator produces population-level consequences.

 

Traditional security failed in each case for essentially the same reason: it was designed around a perimeter that no longer existed, a segmentation model that assumed adversaries had to traverse each Purdue layer, and an asset inventory that did not include third parties, cloud dependencies, remote-access tools, or the actual people (many of them contractors) who could reach the crown jewels. Detection depended on signatures for known malware in an environment where custom, protocol-native attacks left no signature. Response assumed the ability to isolate OT from IT, which in a converged environment often means shutting the plant down.

 

 

What is at stake, in numbers a board can act on

A ransomware event at a bank disrupts a segment of the economy. A ransomware event at a fuel pipeline, a grid operator, a water utility, a rail operator, or a telco backbone disrupts the economy. That is not hyperbole. It is what the last five years of incident history has shown.

 

The specific consequences boards should be modelling include grid instability and prolonged outages (documented incidents put hundreds of thousands of people offline for hours; large-scale public safety shutdowns cost affected economies billions of dollars per event); fuel-distribution disruption (multi-thousand-kilometre pipeline stoppages with cascading economic impact in the hundreds of millions); physical equipment damage (nation-state operations have demonstrated the ability to cause permanent damage to industrial equipment and to misuse protection relays in ways that could destroy transformers); emergency-service disruption (major city governments and national healthcare payment processors have been forced offline for weeks by ransomware, with reported first-quarter financial impacts approaching a billion dollars in one recent case); supply-chain shutdowns (a single first-tier automotive supplier compromise recently shut down one-third of an OEM’s global production for a day; an incidental shipping-industry victim of a nation-state wiper reported approximately USD 300 million in losses); public safety consequences (at least one documented patient death has been linked to hospital ransomware); and national economic disruption of the kind the World Economic Forum has ranked among the top five global risks for three consecutive years.

 

For regulated boards in Australia, the Security of Critical Infrastructure Act (as amended in 2022) has made this concrete. Eleven declared sectors. Mandatory reporting of cyber incidents within 12 to 72 hours. Mandatory risk-management programmes. Government step-in powers under Enhanced Cyber Security Obligations for Systems of National Significance. Equivalent obligations exist in most G20 jurisdictions now: NIS2 in Europe, CIRCIA in the United States, similar frameworks in the United Kingdom, Singapore, Japan and India. A regulator is now watching. So is the media. So are the credit rating agencies, which have explicitly incorporated cyber risk into utility credit assessments since 2023.

 

 

Six moves I would ask an executive to schedule this quarter

I have written enough cyber maturity frameworks to know that most of them fail the test of “what would I actually do differently on Monday morning.” The six moves below are things I would push a utility CEO, CIO, or CISO to actually schedule in the next quarter, in this order.

 

One. Get an honest map of every external access path into your OT environment. Not the map you have. The real one. Every VPN, every remote-access tool (consumer and enterprise), every jump host, every cellular gateway, every satellite terminal, every cloud connector, every managed-service-provider connection, every safety-instrumented-system update pathway. In every OT assessment I have led, this list has been 30 to 300 percent larger than the incumbent OT team believed. This is the single highest-leverage exercise you can do.

 

Two. Enforce phishing-resistant multi-factor authentication on every human and every service account that can reach OT, no exceptions. Phishing-resistant means FIDO2/WebAuthn hardware keys or passkeys, not SMS codes and not app-push MFA. Both of the latter are bypassable by commodity adversary-in-the-middle kits now. This is where the pipeline incident I opened with was lost. Every organisation implements NIST SP 800-207 Zero Trust Architecture in a diagram and forgets to turn on real MFA for the one account that mattered.

 

Three. Segment OT from IT with an assumption that IT will be breached. Not “if” IT is breached. When. The segmentation must survive the breach of your corporate Active Directory. Use IEC 62443 zone-and-conduit design properly, with unidirectional gateways or data diodes for the highest-consequence data flows. Consider deploying confidential-computing enclaves for the crown-jewel engineering workstations. These are not exotic; they are commercially available today.

 

Four. Build a real OT incident-response capability, distinct from your IT SOC. Most utilities I know monitor OT with tools designed for IT and analysts trained on IT playbooks. Detecting protocol-native OT attacks requires OT-native monitoring (any of the three or four established OT-security vendors), analysts who understand IEC 61850 and Modbus, and pre-approved playbooks for what “isolate” and “recover” actually mean when the affected asset is a substation and not a laptop. Regular tabletop exercises with executives, operators and regulators.

 

Five. Treat your top twenty vendors as part of your attack surface, not as suppliers. Recent history has shown that a compromise at a single upstream provider (IT-management vendor, network-management software, file-transfer product, cloud-data-warehouse tenant credentials) cascades to hundreds or thousands of downstream victims. For a utility, the equivalents are your control-system vendors, your telco, your cloud provider, your engineering-services partners, your managed-security-service provider. Contract terms, right-to-audit clauses, mandatory MFA on their side, continuous monitoring, and SBOM requirements under CycloneDX or SPDX are not “nice to have.” They are the difference between a bad quarter and a national event.

 

Six. Assume ransomware operators will target your OT environment directly. The pattern of “breach IT, encrypt IT, force OT shutdown by consequence” is being replaced by direct OT targeting for both extortion and destruction. Your ransomware playbook must include a scenario where the encryption reaches your engineering workstations, your historian, your HMI servers, and possibly your PLC firmware. Backups must be genuinely offline. Recovery time objectives measured against a physical-restoration timeline, not an IT-restoration one.

 

The next three years

Three trends I would bet on.

 

Regulatory floor rises fast. Europe’s NIS2 Directive is now in force. The EU Cyber Resilience Act will begin regulating every internet-connected product sold in Europe from 2027, including industrial IoT. National equivalents in Asia-Pacific and North America are following. Utilities that treat this as a compliance exercise will discover that the regulator soon knows more about their attack surface than their board does. Post-quantum cryptography migration will be mandated for long-lived infrastructure ahead of the “harvest-now, decrypt-later” horizon; NIST’s algorithm standards are already published.

 

Insurance market bifurcates. Cyber-insurance premiums have already risen substantially since 2020, and insurers have narrowed coverage. Expect critical-infrastructure operators to face effective non-coverage for OT-related incidents unless they can demonstrate specific controls (phishing-resistant MFA, EDR on engineering workstations, tested recovery, third-party assurance). The uninsurable will become uninvestable.

 

Nation-state pre-positioning becomes accepted background risk. Recent Five Eyes advisories have named things publicly that used to be classified. That is a deliberate policy choice: intelligence agencies want boards to understand that pre-positioned access in Western utilities is real, is persistent, and is not going away. Utilities will have to plan for the possibility that a subset of their environment is already compromised by an actor waiting for a trigger, and design controls to detect activation and limit blast radius rather than achieve prevention.

 

 

The observation that keeps me awake

I close every conversation I have with a utility board with the same sentence. The next critical-infrastructure crisis in your jurisdiction will not begin with a power station. It will begin with a compromised vendor, a remote-access account, or a telecommunications provider. The technology to prevent it exists. The regulatory pressure to implement it exists. The organisational will to prioritise it above short-term operational efficiency is still forming. The window in which forming it is optional is closing.

 

Next in this series: The Identity Is the New Perimeter. I have written about why the utility perimeter has dissolved. The natural follow-on is who and what now walks through what used to be that perimeter. Attackers rarely break in any more. They log in.

 

 

References and further reading

1. CISA joint advisory on the fuel-pipeline ransomware incident (DarkSide) – https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-131a
2. CISA / FBI / EPA advisory on the water-treatment intrusion – https://www.cisa.gov/news-events/ics-advisories/aa21-042a
3. ESET analysis of the Industroyer / CrashOverride grid attack – https://www.welivesecurity.com/2017/06/12/industroyer-biggest-threat-industrial-control-systems-since-stuxnet/
4. CISA joint advisory on Volt Typhoon pre-positioning in US critical infrastructure – https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a
5. Australia’s Security of Critical Infrastructure Act (Cyber and Infrastructure Security Centre) – https://www.cisc.gov.au/legislation-regulation-and-compliance/soci-act-2018
6. EU NIS2 Directive – https://digital-strategy.ec.europa.eu/en/policies/nis2-directive
7. NIST SP 800-82 Rev 3, Guide to Operational Technology Security (2023) – https://csrc.nist.gov/pubs/sp/800/82/r3/final
8. IEC 62443 series overview – https://www.iec.ch/blog/understanding-iec-62443
9. NIST FIPS 203 (ML-KEM) post-quantum key encapsulation – https://csrc.nist.gov/pubs/fips/203/final
10. World Economic Forum Global Cybersecurity Outlook 2025 – https://www.weforum.org/publications/global-cybersecurity-outlook-2025/