ICS Threats and Real Cases: Colonial Pipeline, NotPetya and What Came After

Reports, rules and advisories described: CISA joint advisories AA23-335A (Dec. 1, 2023), AA24-038A (Feb. 7, 2024) and AA26-097A (April 7, 2026, updated July 22, 2026); the CISA Known Exploited Vulnerabilities catalog, version 2026.10.27; NIST SP 800-82 Rev. 3 (September 2023; a Rev. 4 initial public draft was released Sept. 21, 2026); SEC Form 8-K Item 1.05 and Regulation S-K Item 106 under the SEC's 2023 rule, 88 FR 51896 (effective Sept. 5, 2023, still in effect); TSA Security Directives Pipeline-2021-01G (effective Jan. 16, 2026 to Jan. 15, 2027) and Pipeline-2021-02G (effective May 3, 2026 to May 2, 2027); Lloyd's Market Bulletin Y5381 (Aug. 17, 2022); and industry reports from Dragos (February 2026), IBM X-Force (February 2026), Verizon (2025 DBIR) and the FBI IC3 (2025 report). Everything was checked Oct. 28, 2026. Rules change, advisories are updated, and facts about old cases are sometimes revised (Oldsmar is the example in this lesson), so check the current text before relying on any point.

This lesson is about who goes after factories, utilities, pipelines and water plants, and what actually happened when they did. Lessons 1 and 2 explained the machinery and the standards: what operational technology (OT) is, how the Purdue model sorts plant networks into levels, and what ISA/IEC 62443 and NIST SP 800-82 ask of owners and vendors (lesson 1, lesson 2). Here the subject is the record: the attacks, the losses, the court cases and the lessons defenders took from them.

The cases are told the way a government report or a company filing tells them: dates, numbers, what failed and what changed. There is no attack technique in this lesson beyond what an official advisory says in a sentence, such as "the attackers used a legacy VPN account protected only by a password." That is deliberate. A plant manager, a county commissioner or a reporter does not need to know how to break into a controller. They need to know what went wrong at Colonial, Merck, Norsk Hydro and Aliquippa, so they can ask whether the same gaps exist where they work or where they live.

A few terms used throughout: OT (operational technology) is the hardware and software that monitors and controls physical equipment and processes. An ICS (industrial control system) is the set of controls that runs a process. A PLC (programmable logic controller) is the rugged computer that switches pumps, valves and motors. An HMI (human machine interface) is the screen an operator uses. SCADA (supervisory control and data acquisition) gathers data and sends commands across distances, as on a pipeline or a water system. An SIS (safety instrumented system) is the separate, independent controller that shuts a process down safely when something goes outside safe limits. Lesson 1 explains each in more depth.

Who attacks industrial organizations and why

Defenders who skip this question tend to buy the wrong protection. A plant that worries only about a foreign military may ignore the ransomware crew that is far more likely to show up, and a plant that worries only about ransomware may leave a remote access door open for years to a patient intelligence service. The motive shapes what an attacker wants from a plant: money, a disruption at a chosen moment, a political message, or a foothold for later.

NIST's four kinds of threat source

NIST SP 800-82 Rev. 3, the federal guide to OT security, sorts threats to OT into four kinds: adversarial, accidental, structural and environmental.⁴ Its Table 13 lists the adversarial sources as bot network operators, criminal groups, hackers and hacktivists, insiders, nations and terrorists. The accidental sources are ordinary users and privileged users or administrators making mistakes in the course of their jobs; NIST's examples are an operator "accidentally typing 100 instead of 10 as a set point" and an engineer changing the production system while thinking it is the development environment. Structural threats are hardware and software failures. Environmental threats are fires, floods and storms.

The same guide's opening pages put it in one sentence: threats to OT "can come from numerous sources, including hostile governments, terrorist groups, disgruntled employees, malicious intruders, complexities, natural disasters, malicious actions by insiders, and unintentional actions such human error or failure to follow established policies and procedures."⁴ (The missing "as" is in NIST's text.) The rest of this section takes the groups that matter most to a manufacturer one at a time.

Criminal ransomware crews

Ransomware is malicious software that locks (encrypts) a victim's files and systems until the victim pays. Most crews now also steal data first and threaten to publish it, so a victim with good backups still faces extortion. The crews are businesses. Many rent their software to "affiliates" who do the break-ins and split the ransom. They choose victims by who will pay and who cannot stand to be down, and a factory that loses money every hour its lines are stopped fits that profile exactly.

Ransomware crews usually do not target the control system itself. They encrypt the business network: email, file servers, the enterprise resource planning (ERP) system that holds orders, the systems that print shipping labels and schedule production. The plant then stops for one of three reasons. The control system shares a network or accounts with IT and gets hit too. The plant cannot run without IT, because it cannot see orders, track batches or ship. Or management shuts OT down on purpose because it cannot be sure the attackers have not crossed over. Colonial Pipeline in 2021 is the best-documented example of the third reason; Clorox in 2023 and Jaguar Land Rover in 2025 show the second.

Dragos, an industrial security firm that publishes a widely cited annual review, said ransomware was the most common threat to industrial organizations in 2025, with 119 groups hitting about 3,300 organizations, and that manufacturing was "more than two-thirds" of the industrial ransomware victims it tracked.² Dragos's chief executive, Robert M. Lee, said in the release that "industrial organizations significantly underestimate the reach of ransomware into OT environments."²

Nation states: disruption, espionage and pre-positioning

Governments attack industrial systems for three reasons. The first is disruption as a weapon: Russia's military intelligence agency, the GRU, cut power in Ukraine in 2015 and 2016 and tried again in 2022, and the same unit released NotPetya in 2017, according to U.S. indictments and advisories.¹³¹⁴ The second is espionage: stealing designs, process recipes and bid data. Verizon's 2025 breach report attributed 20 percent of confirmed manufacturing breaches to espionage motives, up from 3 percent a year earlier, a jump Verizon itself said was "most likely due to changes in our contributors' datasets."¹⁵ The third is pre-positioning: getting inside critical infrastructure now and staying quiet, so the access is ready if a crisis comes. That is what U.S. agencies said China's Volt Typhoon group was doing in their February 2024 advisory, with access in some victims "for at least five years."¹⁶

Nation-state work is rarer than ransomware, but it is better funded, more patient, and more willing to touch the control system and even the safety system. Triton, the 2017 attack on safety controllers at a petrochemical plant in Saudi Arabia, is the case that ended any assumption that a safety system was out of reach.¹⁷

Hacktivists and state-backed personas

Hacktivists attack for a cause. In industrial systems, the most important ones in recent years have been personas that look like volunteer activists but are tied to a government. "CyberAv3ngers," which defaced Israeli-made Unitronics PLCs at U.S. water utilities and other sites in late 2023, was described by the FBI, CISA, NSA, EPA and Israel's National Cyber Directorate as an Islamic Revolutionary Guard Corps (IRGC) affiliated group, and the Treasury Department later sanctioned six IRGC officials over it.¹⁸¹⁹ In 2026, U.S. agencies warned that a group of Iranian-affiliated actors was disrupting internet-exposed PLCs across several sectors to "cause disruptive effects within the United States."¹⁰

These groups often pick targets by what they can reach rather than by who the victim is. A small water authority or a food plant with a controller connected straight to the internet can become a victim for no reason except that it was findable. That makes them a real risk to small Idaho operators, who might otherwise assume no one would bother with them.

Insiders

An insider is a current or former employee, contractor or vendor who uses legitimate knowledge or access to do harm. The classic OT example in NIST's guide is the Maroochy Shire sewage spill in Queensland, Australia, in 2000: a former employee of an Australian organization that developed manufacturing software, rejected for a job with the local government, reportedly used a radio transmitter on as many as 46 occasions over two months to interfere with sewage pumping stations, releasing about 264,000 gallons of raw sewage into nearby rivers and parks.⁴ Insider cases are hard to count because many are handled as personnel matters and never made public.

Accidents and well-meaning mistakes

Not every OT incident has an attacker. NIST's guide records cases where routine IT security work hurt a plant: a network scan of an active control network that made a robotic arm swing 180 degrees; another scan that hung a semiconductor fab system and destroyed $50,000 worth of wafers; and a penetration test of a gas utility's corporate network that strayed into a part directly connected to SCADA and stopped the utility from sending gas through its pipelines for four hours.⁴ NIST also describes a security patch on a NASA engineering oven controller whose reboot stopped the oven and impeded alarms, so a fire went undetected for 3.5 hours.⁴ These cases are why lesson 5 treats patching and testing as engineering changes, not routine IT chores.

Accidents also matter because they can look like attacks, and attacks can look like accidents. Dragos reported that 30 percent of its incident response cases began as unexplained operational problems.²⁰ The Triton plant's first shutdown was blamed at first on a mechanical problem, according to later reporting.²¹ Oldsmar, Florida, below, went the other way: an event announced as a hack that the FBI later could not confirm was one.²²

What the data says, and what it cannot say

Every year several companies and agencies publish counts of attacks. They do not measure the same thing, they draw on different customers and reporting channels, and none of them is a census. Read together, though, they point the same direction: manufacturers are hit more often than almost anyone, mostly by criminals, mostly through stolen credentials, remote access and unpatched internet-facing systems, and mostly at small and mid-size companies.

Dragos Year in Review, 2025 and 2026

Dragos sells OT monitoring and incident response, so its numbers come from its own investigations, its customers and public ransomware leak sites. Its reports are the most OT-focused data available.

• 2025 report (covering 2024, released Feb. 25, 2025). Ransomware groups targeting industrial organizations rose to 80 from 50; manufacturing was more than half of ransomware victims; Dragos named two new OT threat groups, BAUXITE and GRAPHITE, and said it tracked 23 groups, 9 of them active. Robert M. Lee: "OT has become a mainstream target." Dragos said BAUXITE has technical overlaps with CyberAv3ngers.²³
• 2026 report (covering 2025, released Feb. 17, 2026). 119 ransomware groups hit about 3,300 industrial organizations, up from 80 groups in 2024; manufacturing was "more than two-thirds" of victims; three new OT threat groups (AZURITE, PYROXENE, SYLVANITE) brought the total tracked to 26, with 11 active in 2025.² The release gives both a 64 percent rise (attacks) and a 49 percent rise (groups); they measure different things, so quote them separately.
• Field findings in the 2026 report. 81 percent of Dragos assessments found poor segmentation between IT and OT; 46 percent found adequate OT network monitoring; 73 percent of all the incident response cases it has worked involved compromised VPN or jump host credentials; and 30 percent of incident response cases began as unexplained operational problems.²⁰
• Second quarter of 2026. Dragos counted 1,140 ransomware incidents affecting industrial organizations, up 12 percent from 1,020 in the first quarter; manufacturing accounted for 747 (about 65 percent) and the United States for 431. The most active groups were Qilin, Akira and The Gentlemen.²⁴

The 73 percent figure deserves a second look, because it describes nearly every case below. A VPN (virtual private network) or a jump host (a hardened computer that remote users must pass through to reach the plant) is supposed to be the guarded front door. When the attacker has a working password for it, the door opens normally. Lesson 4 covers how to build that door so a stolen password is not enough.

IBM X-Force Threat Intelligence Index 2026

IBM's X-Force incident responders found that manufacturing was the most attacked industry for the fifth straight year, with 27.7 percent of the incidents they handled in 2025. The top ways in were exploiting public-facing applications (32 percent), valid accounts (16 percent) and external remote services (11 percent), according to Manufacturing Dive's report on the index.¹ "Valid accounts" means real usernames and passwords that were stolen, bought or guessed. "External remote services" means VPNs, remote desktop and similar doors. Those two together are more than a quarter of the cases.

Verizon Data Breach Investigations Report 2025: manufacturing

Verizon's report counts incidents and confirmed breaches (cases where data was confirmed exposed) from many contributors. For manufacturing (NAICS codes 31 to 33), the 2025 report counted 3,837 incidents and 1,607 confirmed data disclosures, up from 849 the year before.¹⁵ System intrusion patterns were 60 percent of breaches. Ransomware appeared in 47 percent of manufacturing breaches. Among the actions Verizon found in manufacturing breaches, use of stolen credentials appeared in 34 percent, exploited vulnerabilities in 23 percent and phishing in 19 percent. Verizon also found that "more than 90% of breached organizations were SMBs with fewer than 1,000 employees."¹⁵ For Idaho, where most manufacturers are small, that last figure is the one to remember: small does not mean safe, and in Verizon's data it means most of the victims.

Business email compromise (BEC), the fraud in which criminals pose as a supplier or executive to redirect a payment, also hits manufacturers, often through a spoofed supplier invoice. It is covered in module 110, lesson 6 and is not repeated here.

FBI Internet Crime Report 2025

The FBI's Internet Crime Complaint Center (IC3) received more than 3,600 ransomware complaints in 2025, with reported losses over $32 million.²⁵ That loss figure is small because, as the FBI explains, it "does not normally include estimates of lost business, time, wages, files, or equipment, or any third-party remediation services," and some victims report no loss at all, "creating an artificially low overall ransomware loss rate." The more useful line for this module: the top 10 ransomware variants reported to IC3 "most impacted the following Critical Sectors: Critical Manufacturing, Healthcare and Public Health, and Government Facilities." The top three variants were Akira, Qilin and INC/Lynx/Sinobi.²⁵ Govtech reported that IC3 counted more than 2,100 ransomware incidents from critical infrastructure in 2025.²⁶ The exact count for critical manufacturing appears only in a chart image in the report, and this module could not read a labeled figure from it, so it is not stated here.

CISA's Known Exploited Vulnerabilities catalog, as of Oct. 27, 2026

CISA's Known Exploited Vulnerabilities (KEV) catalog lists software flaws that CISA has evidence attackers are actually using. Federal civilian agencies must fix them by deadlines; everyone else can use the list to decide what to patch first. TSA's pipeline directive now requires covered pipelines to prioritize KEV entries in their patch plans.²⁷

The catalog's version 2026.10.27, pulled for this module on Oct. 28, 2026, lists 1,760 vulnerabilities.²⁸ Additions by year: 311 in 2021 (the catalog launched in November 2021 with a backlog), 555 in 2022, 187 in 2023, 186 in 2024, 245 in 2025 and 276 in 2026 through Oct. 27. Of all entries, 361 are flagged as known to be used in ransomware campaigns. The 2025 total, a cumulative 1,484 at year end, matches press reports that the catalog grew about 20 percent in 2025.²⁹

The surprising part is how few KEV entries are OT products. A vendor-name search of the Oct. 27, 2026 catalog found entries for Siemens (2), Rockwell Automation (1), Schneider Electric (1), Unitronics (1) and Delta Electronics (1); a name search may miss some.²⁸ The rest are mostly IT and "edge" devices: firewalls, VPN gateways, remote access tools, file transfer servers, email servers. That matches the case histories. Attackers usually reach OT through the IT and edge equipment around it, not by breaking a PLC first. Patch the edge first.

ICS advisories and MITRE ATT&CK for ICS

Separate from KEV, CISA publishes ICS advisories several times a week describing flaws in control system products and the vendor's fixes. CISA does not publish an annual total; one security vendor's count found over 450 ICS advisories in 2025 covering 2,065 vulnerabilities (CVEs), with critical manufacturing technologies the largest share of affected products (45.8 percent).³⁰ NIST cautions that "not all vendors report known vulnerabilities to CISA," so plants should also subscribe to their own vendors' security notices.⁴

MITRE, a nonprofit that runs federally funded research centers, released ATT&CK for ICS in January 2020 as a shared vocabulary for what adversaries do against industrial systems.³¹ The current matrix has 12 tactics, from Initial Access through Inhibit Response Function, Impair Process Control and Impact, and about 89 techniques.³² NIST SP 800-82 Rev. 3 uses its terms, such as "Denial of control" and "Manipulation of control," in its examples of threat events.⁴ For defenders, the value is a common language: an incident report, a vendor's detection product and a tabletop exercise can all point to the same named behavior. This lesson does not go further into techniques.

Reading the numbers carefully

Two habits help. First, always attribute: "Dragos counted," "IBM's responders found," "Verizon's data showed." Second, do not add or compare numbers across sources as if they measured the same thing. A plant manager can use them for one honest point: attacks on manufacturers are common, they mostly come through ordinary doors, and small firms are not skipped.

Case histories, 2000 to 2026

The cases below are in rough date order. Each one says what happened, what the record shows about how, what it cost, and what defenders learned. Where a fact comes only from press reports, the text says so. Where a widely repeated story turned out to be wrong or unproven, the text says that too.

Before Stuxnet: Maroochy and the Aurora test at INL

Two older events still shape how engineers think. The Maroochy Shire insider case (2000) is described above. The second is an Idaho story. On March 4, 2007, at Idaho National Laboratory (INL) near Idaho Falls, the Aurora Generator Test showed that remotely sent commands could physically destroy a 2.25 megawatt generator. CNN aired video of the test on Sept. 27, 2007, and the Department of Homeland Security released 840 pages of Aurora documents on July 3, 2014, in response to a Freedom of Information Act request.³³ Aurora mattered because it moved the debate from "a hacker could crash a computer" to "a cyberattack can break heavy equipment that takes months to replace." INL has kept that role: CISA's in-person ICS301 training course is held in Idaho Falls with no tuition, and INL says the 301 course has "hosted more than 200 sessions."³⁴

Stuxnet (2010): the first known cyber weapon aimed at a process

The Congressional Research Service summarized what was publicly known in December 2010. Stuxnet was first reported by a Belarusian security firm in June 2010. It attacked a Windows-based application used by a Siemens industrial control system. Iran reported 30,000 infected industrial computer systems, counted by internet address, in September 2010, and the effect on the Natanz uranium enrichment facility was unclear at the time.³⁵ CRS quoted Udo Helmbrecht, then head of the European Network and Information Security Agency: "Stuxnet is really a paradigm shift." NIST's guide describes it as a worm that "initially spread indiscriminately but included a highly specialized malware payload that was designed to only target particular SCADA systems."⁴

For a manufacturer, Stuxnet's lessons are three. A sophisticated attacker can design code to change a physical process while operators see normal readings. A plant that is not connected to the internet can still be reached through removable media, laptops and contractors. And once a weapon is public, its ideas spread: what took a nation-state in 2010 shows up in criminal and hacktivist tools a decade later. No government has officially claimed Stuxnet, and this lesson does not attribute it.

Ukraine, Dec. 23, 2015: the first confirmed grid outage from a cyberattack

On Dec. 23, 2015, three regional electric power distribution companies in Ukraine (oblenergos) suffered what the U.S. government later described as "remote cyber intrusions" that affected "approximately 225,000 customers." The attacks on the three companies came "within 30 minutes of each other."¹⁴ CISA's alert, issued in February 2016 by what was then ICS-CERT, describes the method in one sentence at the level this lesson uses: breakers were opened remotely "using either existing remote administration tools at the operating system level or remote industrial control system (ICS) client software via virtual private network (VPN) connections," with login credentials probably stolen beforehand. The attackers also wiped computers with KillDisk malware and corrupted the firmware of serial-to-Ethernet devices at substations, which made it harder to restore remote control. CISA updated the alert on July 20, 2021, to state that the U.S. government attributes the activity to Russian nation-state actors.¹⁴

The clearest lesson of Ukraine 2015 is that the attackers did not need to break the control system. They used the operators' own remote access, with stolen passwords, to do what operators do. CISA's alert noted that while power had been restored, all three companies "continue to run under constrained operations," and that the attackers also tried to interfere with restoration.¹⁴ That is why the ability to run and restore equipment without the network is a security control, not an embarrassment. For the American grid side of this story, including how U.S. reliability rules responded, see module 20, lesson 8.

Ukraine, December 2016: Industroyer

On the night of Dec. 17 to 18, 2016, an outage hit the Pivnichna transmission substation and cut power in parts of Kyiv and the surrounding region; Ukraine's grid operator, Ukrenergo, said power was fully restored after just over an hour and later confirmed that hackers caused it.³⁶ In June 2017, the security firms ESET and Dragos published analyses of the malware involved, which ESET called Industroyer and Dragos called CrashOverride. The firms described it as malware designed to send commands to electric substation equipment directly, rather than relying on the operators' own tools as in 2015. ESET's researcher warned that it was "really easy to re-purpose," and the Department of Homeland Security said it had seen no evidence of it in U.S. infrastructure.³⁷

In October 2020, a U.S. grand jury in Pittsburgh charged six officers of GRU Unit 74455 with, among other things, "destructive malware attacks against Ukraine's electric power grid, Ministry of Finance, and State Treasury Service" from December 2015 through December 2016, using malware the indictment calls BlackEnergy, Industroyer and KillDisk.¹³ The Justice Department said KillDisk and Industroyer "each caused blackouts in Ukraine."¹³

Industroyer2, April 2022: an attack stopped in time

Weeks after Russia's full-scale invasion, Ukraine's government computer emergency team, CERT-UA, working with ESET and Microsoft, reported that the group known as Sandworm had planned destructive steps against high-voltage substations of a Ukrainian energy company for the evening of April 8, 2022.³⁸ The initial break-in had happened no later than February 2022. Defenders found and stopped the operation before the destructive phase ran. ESET said it assessed "with high confidence that the APT group Sandworm is responsible" and that the new tool, Industroyer2, "only implements the IEC-104 (aka IEC 60870-5-104) protocol," a standard protocol for controlling grid equipment.³⁸

Industroyer2 is the hopeful case in this lesson. It shows what monitoring, outside help and a prepared operator can do: the attackers were inside, the tools were ready, and the lights stayed on. It also shows that the same unit kept working on grid attacks for at least six years.

Triton (2017): an attack on the safety system

Every hazardous process plant has a safety instrumented system (SIS), a separate controller whose only job is to take the process to a safe state, for example by closing valves and stopping feed, when temperatures, pressures or levels go outside safe limits. It is the last automated layer between an upset and an explosion or toxic release. Triton (also called Trisis and, in CISA's report, HatMan) was the first publicly known malware built to attack one.

In December 2017, CISA's predecessor published a malware analysis report on HatMan describing malware that affected Schneider Electric Triconex safety controllers. The report explains that safety PLCs "are normally used to provide a way for a process to safely shut down," and recommends keeping the controller's physical keyswitch out of PROGRAM mode except when changes are actually being made, putting safety systems on isolated networks, and keeping the engineering workstations used to program them off larger networks.³⁹

The Justice Department laid out the case in March 2022, when it unsealed a June 2021 indictment of Evgeny Viktorovich Gladkikh, 36, described as "a computer programmer employed by an institute affiliated with the Russian Ministry of Defense," the Central Scientific Research Institute of Chemistry and Mechanics (TsNIIKhM).¹⁷ According to the Justice Department, between May and September 2017 the conspirators hacked "a foreign refinery" and installed Triton on a Schneider Electric safety system. The malware was designed to keep the safety system from working while the plant appeared normal, but a fault led the plant's safety systems to "initiate two automatic emergency shutdowns," which disrupted the plan. Between February and July 2018, the same conspirators researched similar U.S. refineries owned by a U.S. company and tried, unsuccessfully, to hack it.¹⁷ The charges were conspiracy and attempt to cause damage to an energy facility and conspiracy to commit computer fraud. An indictment is an accusation, and a defendant is presumed innocent unless proven guilty in court.

The Justice Department does not name the plant. Press reports identified it as a petrochemical facility in Saudi Arabia. MIT Technology Review, for example, called it "a petrochemical plant in Saudi Arabia" and reported that the malware "triggered a response from a safety system in June 2017, which brought the plant to a halt," with a second shutdown that August; the first was initially blamed on a mechanical glitch.²¹ The same March 2022 release charged three Russian FSB officers in the separate "Dragonfly" campaign against the energy sector from 2012 to 2017, which included a supply chain attack through software updates that infected more than 17,000 devices and spearphishing of more than 3,300 users at more than 500 companies.¹⁷

What defenders learned from Triton is now written into practice. The safety system must be separated from the control network, not just logically labeled as separate. Physical keyswitches and engineering workstations matter. Unexplained safety trips deserve a security look, not only a mechanical one. And the security risk assessment that the functional safety standard IEC 61511 (2016 edition) requires owners to do for the SIS is not paperwork.⁴⁰ Lesson 5 covers how safety and security engineers work together, including cyber process hazard analysis.

NotPetya, June 27, 2017: the costliest attack on record

On June 27, 2017, destructive malware that came to be called NotPetya spread worldwide. It "damaged computers used in critical infrastructure, and caused enormous financial losses," in the Justice Department's words.¹³ It was not aimed at control systems. It mattered to manufacturers because it took down the business networks that their plants, warehouses and shipping depend on, at companies that were not its intended targets.

The losses are some of the best documented in any cyber event, because public companies had to report them to investors.

• Merck. Merck's annual report on Form 10-K for 2017 says that on June 27, 2017, it "experienced a network cyber-attack that led to a disruption of its worldwide operations, including manufacturing, research and sales operations." Because it could not fill orders for certain products in certain markets, 2017 sales took a hit of "approximately $260 million." Manufacturing-related and remediation expenses "aggregated $285 million in 2017, net of insurance recoveries of approximately $45 million." Merck expected another approximately $200 million in lost 2018 sales from a backlog of orders. The shutdown also contributed to Merck's inability to meet demand for the Gardasil 9 vaccine, so it borrowed doses from the U.S. Centers for Disease Control and Prevention's pediatric vaccine stockpile; the net effect of the borrowing and partial replenishment was a $125 million reduction in 2017 sales.⁵ (The filing reports the Gardasil figure separately; it does not say whether it overlaps the $260 million, so do not add them.) A New Jersey court opinion later noted that "over 40,000 machines in Merck's network were infected."⁸
• FedEx and TNT Express. FedEx's 10-K for the fiscal year ended May 31, 2018, says TNT Express's worldwide operations "were significantly affected by the cyberattack known as NotPetya" and that FedEx's results "were negatively impacted by the NotPetya cyberattack by an estimated $400 million ($1.19 per diluted share)," mainly lost TNT revenue and IT restoration costs.⁶
• Maersk. The Danish shipping company A.P. Moller-Maersk said through chief executive Soren Skou that "the cyber-attack will impact results negatively by USD 200-300m," and that operations had normalized by July 9, 2017, according to Help Net Security's summary of company statements.⁴¹
• Mondelez. The maker of Oreo and Cadbury reported that second-quarter 2017 net revenue fell 5.0 percent, "driven by the (NotPetya) malware incident and currency headwinds," and that organic net revenue fell 2.7 percent, "primarily driven by the impact of the malware incident," per the same summary.⁴¹ Court documents in its later insurance case said it lost "more than 1,700 servers and 24,000 laptops."⁴²
• Saint-Gobain. The French building materials manufacturer reported a "negative impact of EUR 220 million on first-half sales and of EUR 65 million on first-half operating income," with full-year estimates under EUR 250 million in sales and EUR 80 million in operating income.⁴¹

Other companies reported losses too. Reckitt Benckiser's figure, often given as about GBP 100 million in revenue, could not be confirmed in a primary record for this lesson, so it is not charted.

Attribution: the White House statement and the 2020 indictment

On Feb. 15, 2018, the White House press secretary, Sarah Huckabee Sanders, said: "In June 2017, the Russian military launched the most destructive and costly cyber-attack in history."⁴³ On Oct. 19, 2020, the Justice Department announced charges, returned Oct. 15, 2020, by a grand jury in the Western District of Pennsylvania, against six officers of GRU Unit 74455: Yuriy Andrienko, Sergey Detistov, Pavel Frolov, Anatoliy Kovalev, Artem Ochichenko and Petr Pliskin.¹³ The indictment covers NotPetya, the Ukraine grid attacks and other campaigns. The department said NotPetya caused "nearly $1 billion in losses to the three victims identified in the indictment alone": Heritage Valley Health System in Pennsylvania, whose hospitals' "provision of critical medical services" was impaired; TNT Express; and "a large U.S. pharmaceutical manufacturer."¹³ Assistant Attorney General John C. Demers said: "No country has weaponized its cyber capabilities as maliciously or irresponsibly as Russia." The charges are accusations, and the defendants are presumed innocent unless proven guilty in court.

The insurance war-exclusion cases

Government attribution had a consequence no one at the plant had planned for. Many property and casualty policies exclude losses from war or "hostile or warlike action." Once the United States and its allies said the Russian military had launched NotPetya, some insurers argued the exclusion applied. Two big cases tested that.

Merck v. Ace American Insurance Co. Merck sought coverage under its property policies, which carried $1.75 billion in total limits above a $150 million deductible; the opinion says $699,475,000 in coverage was in dispute, and Merck's total claim is usually reported as about $1.4 billion.⁸⁴⁴ A New Jersey trial court granted Merck partial summary judgment on Dec. 6, 2021. On May 1, 2023, the Appellate Division (Judges Currier, Mayer and Enright) affirmed. It held that the hostile or warlike action exclusion "requires the involvement of military action" and that the insurers "did not demonstrate the exclusion applied."⁸ Merck and its insurers settled in early January 2024, before the New Jersey Supreme Court heard the case; the terms were not disclosed.⁴⁴

Mondelez International v. Zurich American Insurance Co. Mondelez sued in Illinois state court in Chicago for at least $100 million under an all-risk property policy after Zurich invoked a war exclusion. The parties settled in late October 2022 and the case was dismissed; a joint statement said "The parties have mutually resolved the matter."⁴²

The market moved anyway. Lloyd's of London issued Market Bulletin Y5381 on Aug. 17, 2022, requiring that from March 31, 2023, at inception or renewal, every standalone cyber-attack policy written at Lloyd's include "a suitable clause excluding liability for losses arising from any state backed cyber-attack," in addition to any war exclusion.⁹ At a minimum the clause must exclude losses from war, exclude state-backed attacks that "significantly impair the ability of a state to function" or its security capabilities, say whether systems outside the affected state are covered, set out how the parties will agree on which state carried out an attack, and define its key terms. Model clauses from the Lloyd's Market Association satisfy the rule.⁹

For a manufacturer, the practical points are simple. Read the war and state-backed exclusions in your cyber and property policies before an incident, ask your broker how attribution would be decided, and do not assume a "silent" property policy covers a cyber loss. The basics of cyber insurance, and how a small business should read a policy, are in module 73, lesson 12.

Norsk Hydro, March 2019: a manufacturer that went manual and told the public

Norsk Hydro, the Norwegian aluminum company, says the attack began in the early hours of March 19, 2019, and "affected our entire global organization." Its Extruded Solutions business, which shapes aluminum into profiles for buildings, cars and other products, was hit hardest. Other units were forced onto "work-intensive workarounds and manual procedures." Hydro estimates the total financial impact at about NOK 800 million.⁴⁵ The ransomware was reported to be LockerGoga; Hydro's own account does not name it.⁴⁶ On the first day, Hydro said it was "switching to manual operations where possible," and its chief financial officer, Eivind Kallevik, said some plants were running in manual mode with more people working extra shifts.⁴⁶

Hydro says its encrypted PCs and servers "were rebuilt based on back-ups" and that it has "resumed normal operations."⁴⁵ Restoring from backups, rather than relying on the attackers, is what made that possible. Hydro's experience also shows what manual operation really costs: it is possible for a while, it takes many more people, and it runs at lower output. A plant that has never practiced running without its business systems will find out what it cannot do on the worst possible day.

Colonial Pipeline, May 2021: an IT attack that stopped the pipeline

Colonial Pipeline is the case most people know, and the one most often told wrong. The public record is unusually good, because Colonial's chief executive, Joseph Blount, testified under oath before the Senate Homeland Security and Governmental Affairs Committee on June 8, 2021.³

The system. In the hearing, Colonial's pipeline was described as spanning "over 5,500 miles" and moving "more than 100 million gallons" of fuel a day; senators said it carried about 45 percent of the East Coast's fuel.³ For how pipelines move fuel and gas and who regulates them, see module 23, lesson 2.

What was hit. Blount told the committee that the attack "encrypted our IT systems." Sen. Rob Portman, the committee's ranking member, said in his opening statement that "On May 7th, Colonial Pipeline learned they suffered a ransomware attack impacting their information technology (IT), systems" by a "Russian-based criminal group called 'DarkSide.'"³ Asked by Sen. Josh Hawley whether the attack was detected only in the IT network and not the OT network, Blount answered: "Senator, that is correct." Then he explained the decision that defined the case: "if there was one percent chance that that OT system was compromised, it was worth shutting the pipeline system down."³ He also told senators that during the shutdown the company kept the pipeline under pressure and had people "manually in the field looking at gauges, the old-school way of watching pipeline pressures."³

How they got in. "We believe the attacker exploited the legacy VPN profile that was not intended to be in use," Blount testified. Asked by Sen. Rob Portman whether the company required multifactor authentication, he said that "in the case of this particular legacy VPN, it did only have single-factor authentication." He added that it "was a complicated password," not a simple one, and that the company's normal remote access used token-based authentication.³ An old account that should have been turned off, protected only by a password, opened the door to one of the country's most important fuel lines.

The ransom. Blount said the company decided the evening of May 7 to negotiate and paid the next day, May 8. Sen. Portman, in his opening statement, said Colonial paid DarkSide "a ransom, we are told, of 75 bitcoins worth over $4 million at the time," and thanked Blount for "acknowledging that his company paid the $4.4 million in ransom."³ The decryption tool the attackers provided "has worked," Blount said, but "it is not a perfect tool." A month later, the company was still bringing back finance systems it had not had "since the morning of May 7th."³

The restart. Colonial began restarting the pipeline around 5 p.m. on Wednesday, May 12, 2021, according to local news reports of company statements at the time, and said it would take several days for deliveries to return to normal.⁴⁷ This module did not find the restart date in a primary government record, so it is attributed to those reports.

The recovery of the ransom. On June 7, 2021, the Justice Department announced it had seized 63.7 bitcoins, then worth about $2.3 million, of the roughly 75 bitcoins Colonial paid, under a seizure warrant authorized by a magistrate judge in the Northern District of California. Deputy Attorney General Lisa Monaco said: "Following the money remains one of the most basic, yet powerful tools we have."⁴⁸ The recovered amount was smaller in dollars for two reasons: fewer coins were recovered (63.7 of about 75), and bitcoin's price had fallen between the payment and the seizure.

What changed. Colonial told senators it had brought in Mandiant, Dragos and others, and that it chose Dragos because "Dragos is very good at operational technology (OT) systems," to get "the best segmentation we can possibly have on our OT side."³ The federal response was faster. TSA issued Security Directive Pipeline-2021-01 on May 26, 2021, effective May 28, requiring covered pipelines to report cybersecurity incidents to CISA within 12 hours, name a 24-hour cybersecurity coordinator, and assess their practices.⁴⁹ A second directive followed in July 2021. Both series are still in force in revised form: Pipeline-2021-01G (effective Jan. 16, 2026 to Jan. 15, 2027, with a 72-hour reporting deadline) and Pipeline-2021-02G (effective May 3, 2026 to May 2, 2027), which requires segmentation "designed to prevent operational disruption to the Operational Technology system if the Information Technology system is compromised or vice versa," multifactor authentication or comparable controls, and patch plans that prioritize KEV entries.²⁷ Lesson 6 covers the directives and the proposed permanent rule in detail.

The single most important lesson of Colonial is in the last line of that graphic. The company shut down a pipeline it had no evidence was compromised, because it could not prove it was not. Segmentation that has been designed, documented and tested lets an operator say with confidence that an IT incident stayed in IT, and keep the plant running, or restart it sooner. Lesson 7 walks through building that proof for a small plant. For the general incident response steps every business needs, including who to call, see module 73, lesson 11 and module 72, lesson 10.

Oldsmar, Florida, February 2021: reported as a hack, later disputed

In February 2021, officials in Pinellas County, Florida, announced that someone had remotely raised the sodium hydroxide (lye) setting at the Oldsmar water treatment plant to "100 times more than normal," and that an operator caught and reversed it. Sheriff Bob Gualtieri called it a "cyberattack," and the story became a fixture of conference talks and news coverage.²²

In March 2023, the former city manager, Al Braithwaite, called it a "nonevent" possibly caused by employee error, and the FBI told the Tampa Bay Times it "was not able to confirm that this incident was initiated by a targeted cyber intrusion of Oldsmar."²² So Oldsmar should be described as what it is: an incident initially reported as a hack whose cause was later disputed and never confirmed as an attack. That does not make every lesson worthless: in the original account, an operator watching the screen was the safeguard that caught the change. But a story repeated without checking can mislead budgets and policy, and both sides of the debate over water system security have cited Oldsmar as proof. Reporters and trainers should stop calling it a confirmed attack.

Unitronics PLCs, CyberAv3ngers and Aliquippa, November 2023

On Saturday, Nov. 25, 2023, the Municipal Water Authority of Aliquippa, Pennsylvania, found that a programmable controller at a booster station serving Raccoon and Potter townships had been disabled. Chairman Matthew Mottes said: "It sent an alarm and we took control manually," and "Nobody was ever at risk."⁵⁰

On Dec. 1, 2023, the FBI, CISA, NSA, EPA and the Israel National Cyber Directorate issued joint advisory AA23-335A. It said IRGC-affiliated actors using the persona "CyberAv3ngers" had, "since at least November 22, 2023," compromised Israeli-made Unitronics Vision Series PLCs, which are used in water and wastewater systems and also in "energy, food and beverage manufacturing, and healthcare." The actors exploited default credentials and left the message: "You have been hacked, down with Israel. Every equipment 'made in Israel' is CyberAv3ngers legal target." Victims spanned "multiple U.S. states."¹⁸ The advisory said the compromised devices "were publicly exposed to the internet with default passwords." Its recommended actions were plain: change the default passwords and use a strong one; "Disconnect the PLC from the public-facing internet"; use multifactor authentication for access to the OT network; put a firewall or VPN in front of any PLC that truly needs remote access; and keep "strong backups of the logic and configurations of PLCs to enable fast recovery."¹⁸

On Feb. 2, 2024, the Treasury Department's Office of Foreign Assets Control sanctioned six officials of the IRGC Cyber-Electronic Command, including its head, Hamid Reza Lashgarian, for the Unitronics hacks; Treasury said the defacements did not disrupt critical services. Under Secretary Brian Nelson called "the deliberate targeting of critical infrastructure by Iranian cyber actors" an "unconscionable and dangerous act."¹⁹

What made Aliquippa important was not damage, because there was little. It was how ordinary the weakness was: a controller reachable from the internet with a factory-default password. The utility's operators could run the station by hand, which turned a hostile act into a nuisance. The advisory lists food and beverage manufacturing among the users of these controllers, and a small plant may well have a controller that an integrator installed years ago with remote access left on for convenience.

Clorox, August 2023: a manufacturer forced back to manual order-taking

The Clorox Company, the maker of bleach, cat litter, charcoal and salad dressing, was hit by a cyberattack in August 2023. Its fiscal 2024 Form 10-K says the company took certain systems offline, brought in outside cybersecurity experts, and implemented business continuity plans "including manual ordering and processing procedures at a reduced rate of operations." The incident "resulted in wide-scale disruptions to the Company's business operations," including "order processing delays and significant product outages," through the rest of the quarter that ended Sept. 30, 2023.⁵¹ Costs included IT recovery and forensic experts, other professional services and "incremental operating costs," which were "partially offset by recognized insurance recoveries in fiscal year 2024."⁵¹ Clorox disclosed $49 million in cyberattack-related expenses through Dec. 31, 2023, "primarily to third-party consulting services," according to BleepingComputer's report on its quarterly filing.⁵² This lesson could not confirm a single cumulative cost figure from the 10-K's tables, so none is given.

Clorox also matters for the disclosure rules. It reported the attack to investors in Form 8-K filings on Aug. 14, Sept. 18 and Nov. 16, 2023, all under Item 8.01 ("Other Events"), not under Item 1.05, the new item for material cybersecurity incidents, which did not take effect for most companies until Dec. 18, 2023.⁵³⁵⁴ Writers sometimes call Clorox an early Item 1.05 case; it was not. Johnson Controls, the building controls manufacturer hit in September 2023, also reported under Item 8.01.⁵³

In July 2025, Clorox sued Cognizant, the outside company that ran its IT service desk, in California state court, seeking $380 million. The complaint alleges that an attacker posing as an employee called the help desk and was given password and multifactor resets without the identity checks Clorox's procedures required. Cognizant disputed the claims and said it "did not manage cybersecurity" for Clorox.⁵⁵ Those are allegations in a pending suit, not findings. The lesson for manufacturers is still useful: the help desk that resets passwords is part of the security perimeter, and so is any outside firm that runs it. Lesson 4 covers vendors.

Volt Typhoon, February 2024: pre-positioning, not theft

On Feb. 7, 2024, CISA, NSA and the FBI, joined by the Department of Energy, EPA, TSA and partner agencies in Australia, Canada, the United Kingdom and New Zealand, issued joint advisory AA24-038A. It said People's Republic of China state-sponsored actors "are seeking to pre-position themselves on IT networks for disruptive or destructive cyberattacks against U.S. critical infrastructure in the event of a major crisis or conflict with the United States."¹⁶ The group, tracked as Volt Typhoon, had compromised IT environments mainly in the communications, energy, transportation, and water and wastewater sectors, including in Guam. The agencies said they assessed "with high confidence" that the actors were positioning "to enable lateral movement to OT assets to disrupt functions," and had seen access in some victims "for at least five years."¹⁶

Volt Typhoon changed how defenders think about "nothing happened." In most of these victims nothing visible did happen. There was no ransom note and no outage. The advisory calls "living off the land" techniques, meaning the use of a victim's own built-in tools, "a hallmark" of the group, which "also relies on valid accounts"; that makes the intruders hard to tell apart from normal IT work.¹⁶ For a plant, the lesson is that the absence of an incident is not evidence of the absence of an intruder. Logging, monitoring of the IT and OT boundary, and periodic hunts for unexplained accounts and remote sessions are what find this kind of guest. Dragos's finding that fewer than half of the plants it assessed had adequate OT network monitoring (46 percent) suggests how many would not know.²⁰

Nucor and other manufacturers in SEC filings, 2025 to 2026

Since Dec. 18, 2023, a public company that decides a cybersecurity incident is material must file a Form 8-K under Item 1.05 within four business days of that decision.⁵⁴ SEC staff said in May 2024 that "Item 1.05 is not a voluntary disclosure" and that companies disclosing incidents they have not found material, or have not yet assessed, are encouraged to use a different item, such as Item 8.01.⁵⁶ Those filings are now one of the best public records of attacks on manufacturers.

The largest U.S. steelmaker, Nucor, filed an Item 1.05 8-K on May 14, 2025, saying it had identified "unauthorized third party access to certain information technology systems," had taken potentially affected systems offline, and "in an abundance of caution" had "temporarily and proactively halted certain production operations at various locations," which it was in the process of restarting.⁵⁷ It amended the filing on June 20, 2025.⁵⁸ Other manufacturers that SEC EDGAR shows filed Item 1.05 reports include Sensata Technologies (April 9, 2025) and the medical device maker Stryker (an amended Item 1.05 filing on April 9, 2026).⁵⁸ A tracker of these filings counted 47 Item 1.05 filings and 31 voluntary Item 8.01 cyber filings from December 2023 to May 2026, and listed among the Item 1.05 filers such manufacturers as Key Tronic, Bassett Furniture, National Presto, Data I/O, Jewett-Cameron, UFP Technologies, Trio-Tech International and West Pharmaceutical Services.⁵⁹ (The individual filings on that tracker's list were not each checked on EDGAR for this lesson.)

On July 16, 2026, Coca-Cola disclosed in an SEC filing a ransomware attack that led it to suspend production at the U.S. facilities of its Fairlife dairy business; Canadian operations were not affected.⁶⁰ How long production was stopped and what it cost had not been confirmed when this lesson was written.

The rule itself is under review. Financial industry groups petitioned the SEC in May 2025 to rescind Item 1.05; the National Association of Manufacturers backed the petition in June 2025; and in January 2026 SEC Chairman Paul Atkins announced a broad review of Regulation S-K. As of Oct. 28, 2026, no amendment had been proposed or adopted, and Item 1.05 remains in effect.⁶¹ Lesson 6 covers the SEC rule with the other sector rules.

Jaguar Land Rover, September 2025: five weeks without production

Jaguar Land Rover (JLR), the British carmaker owned by India's Tata Motors, announced on Sept. 2, 2025, that it had been hit by a cyber incident. Production stopped. According to the company, "manufacturing restarted on a phased basis from 8 October 2025," about five weeks later. Its revenue for the quarter from July to September 2025 was GBP 4.9 billion, down 24 percent, and its exceptional items included "costs of GBP 196m relating to the cyber incident"; the loss before tax and exceptional items was GBP 485 million.⁷

The effect spread down the supply chain, to small parts makers who had no orders to fill while JLR was down. On Sept. 28, 2025, the UK government announced a GBP 1.5 billion loan guarantee through UK Export Finance, to back private bank lending over five years that would support JLR's suppliers.⁶² The UK's Cyber Monitoring Centre, an independent body that rates cyber events, estimated the total economic cost at GBP 1.9 billion, affecting as many as 5,000 UK organizations, and said it "appears to be the most economically damaging cyber event to hit the UK," according to a press report of its findings.⁶³

JLR is the case for small suppliers. A shop that makes brackets or cable assemblies for one big customer can do everything right and still lose a month of revenue when that customer is hit. Business continuity plans for small manufacturers should ask what happens if the largest customer, the largest supplier or the freight carrier goes dark for five weeks.

2026: Iranian-affiliated PLC disruptions (CISA advisory AA26-097A)

On April 7, 2026, the FBI, CISA, NSA, EPA, the Department of Energy, U.S. Cyber Command's Cyber National Mission Force and the Treasury Department issued joint advisory AA26-097A, "Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure."¹⁰ It said the actors "disrupted PLCs across several U.S. critical infrastructure sectors through malicious project file interactions and manipulation of data on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays, resulting in operational disruption and financial loss." The agencies were careful about scale: "In a few cases, this activity caused operational disruption and financial loss."¹⁰ Targets included government services and facilities, including local municipalities, water and wastewater systems, and energy. The advisory notes that the agencies had previously reported similar PLC targeting by CyberAv3ngers, which it describes as affiliated with the IRGC's Cyber Electronic Command.

The first version of the advisory focused on Rockwell Automation (Allen-Bradley) controllers. The July 22, 2026, update expanded it to Schneider Electric, Siemens and "potentially all internet exposed PLCs," and added guidance on spotting unauthorized changes in reusable code modules inside PLC programs.¹⁰ Its key actions are written for owners, not hackers: install PLCs according to the manufacturer's security guidance; "Remove PLCs from direct internet exposure via secure gateway and firewall," working with IT and OT staff or integrators to do it; check logs for the indicators in the advisory; and, for Rockwell devices, "place the physical mode switch on the controller into run position," so the program cannot be changed remotely. Owners who suspect they were targeted are told to contact the authoring agencies and the PLC maker.¹⁰ Any change like these on a running plant should be planned with the equipment vendor, the safety lead and qualified controls engineers, and tested before it goes live.

July 2026: more than 100 U.S. water systems, and Idaho

In late August 2026, CISA confirmed that it had observed attacks against more than 100 internet-exposed U.S. water and wastewater systems in July 2026, in Michigan, Minnesota and at least five other states. Some intrusions modified PLCs to disable shutdown processes and alarms. U.S. intelligence reportedly believes Iran is likely behind the attacks, which were largely opportunistic, according to TechCrunch's report.¹¹

Minnesota was hit hardest on July 26 and 27, 2026. More than 30 communities were affected. Braham's well and treatment plant were shut down temporarily and restored in about two hours; Plymouth disconnected cellular-connected equipment at two water towers and lift stations and ran them by hand; Maple Plain declared a local emergency; and state officials said drinking water quality was not affected, according to a summary by the security firm Tenable.⁶⁴

And Idaho: an Idaho Statesman report published Sept. 8, 2026, said "Idaho systems weren't targeted in this summer's attacks."¹² The same report described the state's own capacity as thin: the Idaho Information Technology Services Cyber Resilience Operation Center in Boise had four full-time employees plus part-time staff as of September 2026 and aims for "fully manned, 24/7 operations" by June 2027, with regional teams in Moscow and Twin Falls. State Rep. Ted Hill, R-Eagle, told the paper: "We are extremely vulnerable."¹² This module found no publicly documented control system incident at an Idaho manufacturer or utility. That is not proof none has happened; most private incidents are never made public.

Lessons learned across the cases

Lay the cases side by side and the same handful of failures appear again and again. None requires exotic technology to fix. Most require a plant to know what it has, close doors it forgot were open, separate the plant from the office in a way it can prove, and practice running and recovering without the network. The right-hand column points to the lesson in this module that covers each fix.

Four patterns stand out.

1. Remote access is the front door. Colonial's legacy VPN, Ukraine's stolen credentials, Dragos's finding that 73 percent of its all-time incident response cases involved compromised VPN or jump host credentials, and IBM's finding that valid accounts and remote services together started more than a quarter of incidents all say the same thing.²⁰¹ A password alone is not enough for any door into a plant.
2. The plant stops because of IT more often than because of an attack on OT. Colonial, Norsk Hydro, Clorox, NotPetya's victims and JLR all lost production because business systems failed or because no one could prove OT was clean. Segmentation is valuable less for keeping attackers out entirely than for letting a plant keep running, or restart quickly, with confidence.
3. Exposure invites attack. Aliquippa and the 2026 campaigns found their victims by what was reachable, not by who they were. If a controller can be reached from the internet, assume it will be found.
4. People with manual skills turned disasters into inconveniences. Aliquippa's operators took over by hand. Colonial watched gauges in the field. Hydro ran plants manually. Ukraine's companies kept running "under constrained operations."¹⁴ Plants should keep those skills, write down the procedures, and practice them, after checking with the safety lead that manual operation is itself safe for the process.

What the cases mean for an Idaho plant

Idaho had about 77,500 manufacturing jobs in September 2026 (preliminary, seasonally adjusted), up from 74,900 a year earlier, out of about 890,100 nonfarm jobs, so manufacturing is nearly 9 percent of Idaho's nonfarm jobs.⁶⁵ The best-known names are large: Micron Technology, J.R. Simplot Co. and Amalgamated Sugar are among the state's 15 largest private employers.⁶⁶ But most Idaho manufacturers are small food processors, metal shops, wood products mills and equipment makers, and many of the state's water systems are run by small cities and districts. Those are exactly the organizations the 2023 and 2026 campaigns found by scanning for exposed controllers, and exactly the "SMBs with fewer than 1,000 employees" that Verizon found made up more than 90 percent of breached manufacturers.¹⁵

Read against the cases, a small Idaho plant's first questions are short:

1. What can reach our controllers from outside? Any PLC, HMI or remote access box reachable from the internet is the Aliquippa and AA26-097A problem. Ask the integrator who installed it, and the cellular modem vendor if there is one.
2. Who has remote access, and does every door require more than a password? That is the Colonial and Ukraine problem. Old accounts for former employees, former integrators and "temporary" vendor connections are the usual surprises.
3. If our office network went down tonight, could the plant keep running, and could we prove the plant was clean? That is the Colonial, Hydro, Clorox and JLR problem.
4. Could we run by hand, and have we practiced? That is what saved Aliquippa, and what Minnesota's towns did in July 2026.
5. What do our insurance policies exclude? That is the Merck and Mondelez problem.

Help is close. CISA's in-person ICS301 course is held in Idaho Falls with no tuition, and INL developed Consequence-driven Cyber-informed Engineering, a method for finding the few events that would hurt a plant most and engineering them out.³⁴ Lesson 5 covers that method. Any change these questions lead to on a running plant should be planned with the equipment vendor, the safety lead and qualified engineers, and tested before it goes live.

Common mistakes

These mistakes come from the documented cases in this lesson, not from hypotheticals.

• Leaving an old remote access account alive. Colonial's way in was a "legacy VPN profile that was not intended to be in use," protected by a password alone.³ Every plant has accounts like it until someone looks.
• Treating a password as enough for a remote door. Colonial's account had "only single-factor authentication"; Ukraine's attackers used stolen credentials on real VPN connections; and Dragos ties 73 percent of its all-time incident response cases to compromised VPN or jump host credentials.³¹⁴²⁰
• Putting a controller on the internet with the factory password. CISA's AA23-335A told owners to "Check PLCs for default passwords" after CyberAv3ngers used default credentials; three years later AA26-097A still had to tell owners to "Remove PLCs from direct internet exposure."¹⁸¹⁰
• Not being able to prove OT is separate. Colonial's control network was not shown to be compromised, but the company shut the pipeline because "if there was one percent chance that that OT system was compromised, it was worth shutting the pipeline system down."³ Dragos found poor IT and OT segmentation in 81 percent of its assessments.²⁰
• Assuming a safety system cannot be touched. According to the Justice Department, the conspirators "designed the Triton malware to prevent the refinery's safety systems from functioning" while the plant looked normal.¹⁷
• Calling an unexplained trip a mechanical problem without asking a second question. The first Triton shutdown was initially blamed on a mechanical glitch, according to later reporting, and 30 percent of Dragos's incident response cases began as unexplained operational problems.²¹²⁰
• Having backups that the attack can reach, or no rebuild plan. NotPetya and Norsk Hydro showed how fast a whole company's computers can be lost; Hydro says its encrypted PCs and servers "were rebuilt based on back-ups."⁴⁵
• Trusting the help desk without checking identity. Clorox's lawsuit alleges an attacker got password and multifactor resets just by calling and asking; the claim is disputed, but the risk is real for any help desk.⁵⁵
• Assuming property or cyber insurance will pay for a state-attributed attack. Merck and Mondelez spent years in court over war exclusions, and Lloyd's policies now carry state-backed attack exclusions by rule.⁸⁴²⁹
• Repeating a case without checking it. Oldsmar is still cited as a confirmed hack, even though the FBI "was not able to confirm" it was a targeted intrusion.²²
• Calling Clorox an Item 1.05 filer. Its 2023 8-Ks were filed under Item 8.01, before Item 1.05 took effect for most companies.⁵³

Questions people ask

Did the Colonial Pipeline hackers get into the pipeline's controls?

Not according to the record. Colonial's chief executive testified that the attack was detected only in the IT network and that the company shut the pipeline down as a precaution, because it could not rule out that OT was affected.³ The fuel shortage came from that choice and from the time it took to be sure, not from attackers operating the pipeline.

We are a small plant. Why would anyone attack us?

Because many attackers do not pick victims by name. Ransomware crews look for any company that will pay and cannot afford downtime. The CyberAv3ngers and 2026 campaigns found victims by what was reachable from the internet, which is how a small Pennsylvania water authority and dozens of Minnesota towns ended up in the news.¹⁸⁶⁴ Verizon found that more than 90 percent of breached manufacturers in its 2025 data had fewer than 1,000 employees.¹⁵

Should we ever pay a ransom?

That is a business decision with legal limits, and it belongs with your executives, your insurer and your incident response team, made before an incident if possible. Paying does not guarantee recovery: Colonial paid about $4.4 million and its chief executive said the decryptor "is not a perfect tool," and a month later the company was still restoring finance systems.³ Paying a group on a U.S. sanctions list can itself be a violation; senators asked Colonial whether DarkSide was sanctioned, and Blount said that question "was fact-checked repeatedly."³ Report to the FBI either way; the Justice Department recovered most of Colonial's bitcoin.⁴⁸

Is Oldsmar a real example of a water plant hack?

It was announced as one in 2021, but the FBI later said it "was not able to confirm that this incident was initiated by a targeted cyber intrusion," and the former city manager called it a "nonevent" possibly caused by employee error.²² Use Aliquippa (2023) or the July 2026 attacks instead; those are confirmed by federal agencies.¹⁸¹¹

Why did insurers say NotPetya was war, and who won?

Because the U.S. government said the Russian military launched it, some insurers invoked exclusions for war or hostile and warlike action.⁴³ In Merck's case, a New Jersey appeals court held on May 1, 2023, that the exclusion "requires the involvement of military action," and the insurers lost; the case then settled in January 2024. Mondelez's case against Zurich settled in October 2022 without a ruling.⁸⁴⁴⁴² Since 2023, Lloyd's has required standalone cyber policies to carry explicit state-backed attack exclusions, so the next fight will be over policy wording that did not exist in 2017.⁹

What does "pre-positioning" mean, and should a factory care?

It means getting into a network and staying quietly, not to steal or disrupt now, but to be ready to disrupt later in a crisis. U.S. agencies said that is what Volt Typhoon was doing in communications, energy, transportation and water networks, sometimes for at least five years.¹⁶ Most Idaho factories are not the intended target, but suppliers to utilities, defense contractors and makers of equipment used by critical infrastructure may be, and the defenses are the same ones that stop criminals: strong remote access, logging and monitoring.

Wouldn't unplugging the plant from everything solve this?

Partly, and at a price. Stuxnet showed that removable media and laptops can cross a gap.³⁵ And most plants today need data from the business network to schedule, track and ship, and need vendors to support equipment remotely, which is why the gap usually turns into a set of exceptions no one has written down. The approach in this module is controlled, documented, monitored connections, covered in lesson 7.

Hard questions

Should paying a ransom be banned for critical infrastructure?

The case for a ban: payments fund the crews and make every other company a target; a ban takes the decision off a chief executive's desk at 2 a.m.; and Colonial's own payment bought a tool that was "not a perfect tool," with recovery taking months anyway.³ The case against: a ban could force a hospital, water system or pipeline to stay down when paying would restore service faster; companies might pay quietly and stop reporting to the FBI, losing the cooperation that let the Justice Department recover 63.7 bitcoins; and small firms without good backups would be hurt most.⁴⁸ What the evidence shows: recovery after payment is slow and partial even when the key works, and reporting to law enforcement produced a real recovery at Colonial. Evidence on whether payment bans reduce attacks is limited. The strongest point both sides share: good backups and practiced manual operation make the question less urgent.

Should insurance cover attacks by foreign governments?

The case for coverage: a manufacturer cannot control whether a criminal or a government attacked it, and NotPetya's victims, like Merck, had no part in the conflict between Russia and Ukraine; attribution can take months and is a political act, so tying coverage to it leaves companies unsure what they bought.⁸ The case for exclusions: a single state attack can hit thousands of companies at once, like a war or a hurricane with no geographic limit, and private insurers cannot hold enough capital for that; Lloyd's says clear exclusions make the market sustainable.⁹ What the evidence shows: courts read old war exclusions narrowly in Merck's case, and the market answered with new wording rather than broader coverage.

Should a plant shut down its operations when IT is hit, as Colonial did?

The case for shutting down: if attackers could be in the control system, running a pipeline, a chemical process or a water plant is a safety gamble, and Blount's "one percent chance" logic is how safety engineers think.³ The case against an automatic shutdown: Colonial's precaution caused the public harm, fuel shortages along the East Coast, that the attackers alone had not caused; a shutdown and restart carries its own operating risks; and a plant that can prove its segmentation does not need to stop. What the evidence shows: the decision is only as good as the evidence available in the first hours. TSA's directive now requires pipelines to keep OT running if IT is compromised "or vice versa" through segmentation, which treats the ability to keep running safely as the goal.²⁷ The safety lead, not the IT department alone, should own the shutdown decision, and the criteria should be written down before an incident.

Who should pay to get controllers off the internet: owners, vendors or taxpayers?

The case for owners: the owner chose to connect the device, and fixing it is often cheap: change a password, put it behind a firewall, turn off remote access that is not needed, as AA23-335A and AA26-097A advise.¹⁸¹⁰ The case for vendors: devices that ship with default passwords and remote programming turned on make insecure installation the easy path; A January 2025 "Secure by Demand" guide from CISA and partner agencies observed that threat actors "target specific OT products rather than specific organizations" and that many OT products have "insecure default settings and passwords."⁶⁷ The case for public money: small water systems and tiny manufacturers serve the public, have no security staff, and live on thin rates or margins; the July 2026 attacks fell on exactly those systems.¹¹ What the evidence shows: the same weakness, internet-exposed controllers with weak access, appeared in 2023 and again across more vendors in 2026, three years of advisories later, which suggests voluntary owner action alone has not been enough. Idaho's own state cyber center was still building toward round-the-clock staffing in 2026.¹²

Where to go next

• CISA Known Exploited Vulnerabilities Catalog: Free. CISA's list of flaws attackers are actually using, downloadable as a spreadsheet or JSON file. Use it to set patch priorities for edge devices, VPNs and remote access tools first; check it weekly or subscribe to updates.
• CISA Industrial Control Systems page (advisories and resources): Free. Links to ICS advisories, joint advisories such as AA26-097A, assessments and training. Plant staff can subscribe to advisory emails and match them against their own equipment list.
• Idaho National Laboratory: Industrial Control Systems Cybersecurity Training: Free, no tuition. CISA's online ICS courses and the in-person ICS301 course in Idaho Falls, for controls engineers, technicians and IT staff who support plants.
• MITRE ATT&CK for ICS matrix: Free. A shared vocabulary of adversary behavior against industrial systems. Useful for reading advisories and vendor reports and for planning tabletop exercises, not as a checklist.
• Colonial Pipeline hearing transcript, S. Hrg. 117-429: Free. The primary record of the most-cited U.S. industrial cyber incident, in the CEO's own words under questioning. Good reading for managers deciding in advance when to shut a plant down.
• Secure by Demand: Priority Considerations for OT Owners and Operators (CISA and partners, Jan. 2025): Free. A buyer's guide listing 12 security elements to ask OT vendors about, from secure defaults to logging and patch tooling. Use it when buying or replacing controllers and remote access products.
• SEC EDGAR full-text search: Free. Search public companies' 8-K and 10-K filings for cybersecurity incidents (Item 1.05 and Item 8.01) and costs. Useful to reporters, investors and suppliers checking on a customer.

Still being checked (10 items)

These points could not be fully confirmed against a primary source when this lesson was written and fact checked in October 2026. The text above states each one as uncertain.

• Colonial Pipeline's restart on the evening of May 12, 2021 is from local news reports of company statements; it was not found in a primary government record.
• Reckitt Benckiser's NotPetya loss (often reported as about GBP 100 million) could not be confirmed in a primary record and is not stated as fact.
• Clorox's cumulative cost for the August 2023 attack could not be read from the 10-K tables; only the $49 million through Dec. 31, 2023 (press report of its 10-Q) is given.
• The exact count of critical manufacturing ransomware complaints in the FBI IC3 2025 report appears only in a chart image and was not stated.
• The duration and cost of the July 2026 Coca-Cola Fairlife production suspension were not confirmed.
• The Triton plant is not named by DOJ ("a foreign refinery"); its identification as a petrochemical plant in Saudi Arabia rests on press reports.
• Item 1.05 filers listed by the Cherry Hill Advisory tracker were not each checked on EDGAR (Nucor, Sensata and Stryker were).
• Aurora Generator Test details come from a secondary source (Wikipedia citing CNN, DHS FOIA records and Wired).
• The count of OT vendor entries in the KEV catalog comes from a vendor-name search and may miss some entries.
• Merck's 10-K does not say whether its $125 million Gardasil 9 sales effect overlaps the $260 million sales effect; they are not added.

Last verified October 28, 2026. General education, not legal, engineering, safety or compliance advice; rule versions and dates are stated in the text, and the sources used are listed in the Notes and Sources below. Check the regulator's current text before relying on any point.

Notes

1. Manufacturing Dive, report on the IBM X-Force Threat Intelligence Index 2026, Feb. 26, 2026: manufacturing most attacked industry for the fifth straight year (27.7 percent of incidents in 2025); top initial access vectors public-facing applications (32 percent), valid accounts (16 percent), external remote services (11 percent). Press report of a vendor study (read Oct. 28, 2026). Read it online. ↩
2. Dragos, press release on the Dragos 2026 OT Cybersecurity Year in Review (covering 2025), Feb. 17, 2026: 119 ransomware groups, about 3,300 industrial organizations, manufacturing "more than two-thirds" of victims, new groups AZURITE, PYROXENE and SYLVANITE, 26 groups tracked, 11 active; quote from CEO Robert M. Lee. Vendor report (read Oct. 28, 2026). Read it online. ↩
3. U.S. Senate, Committee on Homeland Security and Governmental Affairs, Threats to Critical Infrastructure: Examining the Colonial Pipeline Cyber Attack, S. Hrg. 117-429, June 8, 2021, testimony of Joseph Blount, President and CEO, Colonial Pipeline Co., and statements of Chairman Gary Peters and Sens. Rob Portman, Josh Hawley and others (govinfo.gov transcript) (read Oct. 28, 2026). Read it online. ↩
4. NIST, Guide to Operational Technology (OT) Security, SP 800-82 Rev. 3, September 2023: Sec. 1 (threat sources, p. 2), Sec. 6.2.11 (vendor vulnerability reporting, p. 125), Appendix C.1, Table 13 (threat sources, p. 169), and Appendix C.3 (incidents: Stuxnet and Maroochy Shire, pp. 181 to 182; accidental events including scanner, penetration test and NASA oven incidents, pp. 184 to 185), and Table 21 (threat events). A Rev. 4 initial public draft was released Sept. 21, 2026 (read Oct. 28, 2026). Read it online. ↩
5. Merck and Co., Inc., Annual Report on Form 10-K for the fiscal year ended Dec. 31, 2017 (SEC EDGAR), sections on the June 27, 2017 cyber-attack: sales effect of approximately $260 million in 2017, expenses of $285 million net of insurance recoveries of approximately $45 million, approximately $200 million expected 2018 sales effect, and Gardasil 9 borrowing with a net $125 million 2017 sales reduction (read Oct. 28, 2026). Read it online. ↩
6. FedEx Corp., Annual Report on Form 10-K for the fiscal year ended May 31, 2018 (SEC EDGAR): TNT Express operations "significantly affected by the cyberattack known as NotPetya"; results "negatively impacted by the NotPetya cyberattack by an estimated $400 million ($1.19 per diluted share)" (read Oct. 28, 2026). Read it online. ↩
7. JLR, "JLR performance impacted in challenging quarter," media release, November 2025: incident announced Sept. 2, 2025; manufacturing restarted on a phased basis from Oct. 8, 2025; Q2 FY26 revenue GBP 4.9 billion, down 24 percent; GBP 196 million in cyber incident costs; loss before tax and exceptional items GBP 485 million (read Oct. 28, 2026). Read it online. ↩
8. Merck and Co., Inc. v. Ace American Insurance Co., No. A-1879-21 (N.J. Super. Ct. App. Div., May 1, 2023) (Judges Currier, Mayer and Enright), affirming the trial court's Dec. 6, 2021 grant of partial summary judgment to Merck; opinion text at Justia (read Oct. 28, 2026). Read it online. ↩
9. Lloyd's, Market Bulletin Y5381, "State backed cyber-attack exclusions," Aug. 17, 2022 (Tony Chaudhry, Underwriting Director), requirements effective March 31, 2023 (read Oct. 28, 2026). Read it online. ↩
10. FBI, CISA, NSA, EPA, DOE, USCYBERCOM Cyber National Mission Force and Treasury, joint cybersecurity advisory AA26-097A, "Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure," April 7, 2026, updated July 22, 2026 (read Oct. 28, 2026). Read it online. ↩
11. TechCrunch, "CISA confirms hackers targeted over 100 US water systems during July," Aug. 26, 2026. Press report (read Oct. 28, 2026). Read it online. ↩
12. Idaho Statesman, republished by East Idaho News, Sept. 8, 2026, on Idaho's cyber readiness after the summer 2026 water attacks ("Idaho systems weren't targeted in this summer's attacks"; staffing of the ITS Cyber Resilience Operation Center; quote from Rep. Ted Hill). Press report (read Oct. 28, 2026). Read it online. ↩
13. U.S. Department of Justice, "Six Russian GRU Officers Charged in Connection with Worldwide Deployment of Destructive Malware and Other Disruptive Actions in Cyberspace," press release, Oct. 19, 2020 (indictment returned Oct. 15, 2020, W.D. Pa.) (read Oct. 28, 2026). Read it online. ↩
14. CISA (then ICS-CERT), ICS Alert IR-ALERT-H-16-056-01, "Cyber-Attack Against Ukrainian Critical Infrastructure," Feb. 25, 2016, updated July 20, 2021 to state U.S. government attribution to Russian nation-state actors (read Oct. 28, 2026). Read it online. ↩
15. Verizon, 2025 Data Breach Investigations Report, Manufacturing (NAICS 31-33) section, pp. 79 to 80 (read Oct. 28, 2026). Read it online. ↩
16. CISA, NSA, FBI and partners, joint cybersecurity advisory AA24-038A, "PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure," Feb. 7, 2024 (read Oct. 28, 2026). Read it online. ↩
17. U.S. Department of Justice, "Four Russian Government Employees Charged in Two Historical Hacking Campaigns Targeting Critical Infrastructure Worldwide," press release, March 24, 2022 (Triton indictment of Evgeny Viktorovich Gladkikh, D.D.C., June 2021; Dragonfly indictment of three FSB officers) (read Oct. 28, 2026). Read it online. ↩
18. FBI, CISA, NSA, EPA and Israel National Cyber Directorate, joint advisory AA23-335A, "IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities," Dec. 1, 2023 (read Oct. 28, 2026). Read it online. ↩
19. U.S. Department of the Treasury, "Treasury Sanctions IRGC-Affiliated Cyber Actors for Hacking U.S. Critical Infrastructure," press release JY2072, Feb. 2, 2024 (read Oct. 28, 2026). Read it online. ↩
20. Dragos, "Dragos 2026 OT Cybersecurity Year in Review" blog: 81 percent of assessments found poor IT/OT segmentation; 46 percent found adequate OT network monitoring; 73 percent of all-time incident response cases involved compromised VPN or jump host credentials; 30 percent of incident response cases began as unexplained operational problems. Vendor report (read Oct. 28, 2026). Read it online. ↩
21. MIT Technology Review, "Triton is the world's most murderous malware, and it's spreading," March 5, 2019. Press report (read Oct. 28, 2026). Read it online. ↩
22. WUSF Public Media, report on the 2021 Oldsmar water treatment plant incident, April 13, 2023, quoting former city manager Al Braithwaite and the FBI's statement to the Tampa Bay Times. Press report (read Oct. 28, 2026). Read it online. ↩
23. Dragos, press release on the Dragos 2025 OT/ICS Cybersecurity Year in Review (covering 2024), via BusinessWire, Feb. 25, 2025. Vendor report (read Oct. 28, 2026). Read it online. ↩
24. Help Net Security, report on Dragos data for industrial ransomware in the second quarter of 2026, Aug. 11, 2026. Press report of vendor data (read Oct. 28, 2026). Read it online. ↩
25. Federal Bureau of Investigation, Internet Crime Complaint Center, 2025 IC3 Annual Report, ransomware section, pp. 14 to 16 (read Oct. 28, 2026). Read it online. ↩
26. Govtech, report on the FBI's 2025 ransomware figures for critical infrastructure, April 14, 2026. Press report (read Oct. 28, 2026). Read it online. ↩
27. TSA, Security Directive Pipeline-2021-02G, "Pipeline Cybersecurity Mitigation Actions, Contingency Planning, and Testing," effective May 3, 2026 through May 2, 2027, with transmittal memo dated May 1, 2026 (sections III.B segmentation, III.C access control, III.E patching); the companion directive Pipeline-2021-01G is effective Jan. 16, 2026 through Jan. 15, 2027 (read Oct. 28, 2026). Read it online. ↩
28. CISA, Known Exploited Vulnerabilities catalog, JSON feed, catalog version 2026.10.27; counts by year, ransomware flag and vendor names computed for this module from the downloaded file (read Oct. 28, 2026). Read it online. ↩
29. SecurityWeek, "CISA KEV Catalog Expanded 20% in 2025, Topping 1,480 Entries" (headline). Press report (read Oct. 28, 2026). Read it online. ↩
30. SOCRadar, "CISA Industrial Control Systems (ICS) Advisories Recap for 2025." Vendor count; CISA does not publish an annual total (read Oct. 28, 2026). Read it online. ↩
31. WaterISAC, "MITRE Releases ATT&CK for ICS as Common Lexicon for Industrial Cyber Defense Strategy," January 2020 (read Oct. 28, 2026). Read it online. ↩
32. MITRE ATT&CK, ICS Matrix (12 tactics, about 89 techniques as displayed) (read Oct. 28, 2026). Read it online. ↩
33. Wikipedia, "Aurora Generator Test," citing CNN (Sept. 27, 2007), the DHS FOIA release of July 3, 2014, and Wired (Oct. 23, 2020). Secondary source; the test date and generator size are as reported there (read Oct. 28, 2026). Read it online. ↩
34. Idaho National Laboratory, "Industrial Control Systems Cybersecurity Training" (ICS301 held in Idaho Falls; "hosted more than 200 sessions"), and INL, "Consequence-Driven Cyber-Informed Engineering" (read Oct. 28, 2026). Read it online. ↩
35. Congressional Research Service, Paul K. Kerr, John Rollins and Catherine A. Theohary, The Stuxnet Computer Worm: Harbinger of an Emerging Warfare Capability, R41524, Dec. 9, 2010 (read Oct. 28, 2026). Read it online. ↩
36. SecurityWeek, "Ukraine Power Company Confirms Hackers Caused Outage," January 2017, quoting Ukrenergo on the Dec. 17 to 18, 2016 outage at the Pivnichna substation. Press report (read Oct. 28, 2026). Read it online. ↩
37. Insurance Journal (Reuters), "Utilities Warned of 'Easy-to-Use' Malware Aimed at Causing Outages," June 13, 2017, on ESET and Dragos analyses of Industroyer/CrashOverride and the DHS response. Press report (read Oct. 28, 2026). Read it online. ↩
38. Help Net Security, "Sandworm hackers tried (and failed) to disrupt Ukraine's power grid," April 12, 2022, reporting CERT-UA and ESET findings on Industroyer2. Press report (read Oct. 28, 2026). Read it online. ↩
39. CISA (NCCIC), Malware Analysis Report MAR-17-352-01, "HatMan: Safety System Targeted Malware," Dec. 18, 2017 (read Oct. 28, 2026). Read it online. ↩
40. exida, Steve Gandy, "How Secure Is Your Safety Instrumented System (SIS)?," Sept. 8, 2016, summarizing IEC 61511-1:2016 clause 8.2.4 (security risk assessment of the SIS). The standard itself is sold by IEC and ISA and is described, not quoted (read Oct. 28, 2026). Read it online. ↩
41. Help Net Security, report on NotPetya losses at Maersk, Saint-Gobain, Mondelez and others, Aug. 17, 2017, quoting company statements (Maersk CEO Soren Skou; Saint-Gobain; Mondelez). Press report of company statements (read Oct. 28, 2026). Read it online. ↩
42. The Record, "Mondelez and Zurich reach settlement in NotPetya cyberattack insurance suit," Oct. 31, 2022. Press report (read Oct. 28, 2026). Read it online. ↩
43. The White House, "Statement by the Press Secretary on the 'NotPetya' Cyber-Attack," Feb. 15, 2018 (Press Secretary Sarah Huckabee Sanders), text archived by The American Presidency Project, University of California, Santa Barbara; also reported by Axios the same day (read Oct. 28, 2026). Read it online. ↩
44. Business Insurance, report on the settlement between Merck and its insurers over NotPetya coverage, Jan. 5, 2024 (terms not disclosed; Merck's claim reported at about $1.4 billion). Press report (read Oct. 28, 2026). Read it online. ↩
45. Norsk Hydro, "Cyber attack" (company account of the March 19, 2019 attack; total cost estimated at around NOK 800 million; systems "rebuilt based on back-ups") (read Oct. 28, 2026). Read it online. ↩
46. BleepingComputer, "LockerGoga Ransomware Sends Norsk Hydro Into Manual Mode," March 19, 2019. Press report (read Oct. 28, 2026). Read it online. ↩
47. WBTV (Charlotte), report that Colonial Pipeline had initiated the restart of pipeline operations, May 12, 2021, citing company statements. Press report; the restart date was not found in a primary government record (read Oct. 28, 2026). Read it online. ↩
48. U.S. Department of Justice, "Department of Justice Seizes $2.3 Million in Cryptocurrency Paid to the Ransomware Extortionists Darkside," press release, June 7, 2021 (read Oct. 28, 2026). Read it online. ↩
49. TSA, "Ratification of Security Directive," Federal Register, Sept. 24, 2021 (Security Directive Pipeline-2021-01 issued May 26, 2021, effective May 28, 2021, requiring incident reports to CISA within 12 hours) (read Oct. 28, 2026). Read it online. ↩
50. WaterWorld, "Aliquippa, Pennsylvania suffers cyberattack on booster station PLC," November 2023, quoting Municipal Water Authority of Aliquippa Chairman Matthew Mottes. Press report (read Oct. 28, 2026). Read it online. ↩
51. The Clorox Co., Annual Report on Form 10-K for the fiscal year ended June 30, 2024, filed Aug. 8, 2024 (Item 1A risk factors, Item 1C cybersecurity, and management's discussion of the August 2023 cyberattack) (read Oct. 28, 2026). Read it online. ↩
52. BleepingComputer, "Clorox says cyberattack caused $49 million in expenses," Feb. 3, 2024, reporting Clorox's quarterly filing for the period ended Dec. 31, 2023. Press report (read Oct. 28, 2026). Read it online. ↩
53. SEC EDGAR filing index, The Clorox Co. (CIK 0000021076): Form 8-K filings of Aug. 14, 2023 (Items 8.01, 9.01), Sept. 18, 2023 (Item 8.01) and Nov. 16, 2023 (Items 5.07, 8.01, 9.01); Johnson Controls International (CIK 0000833444) 8-Ks with Item 8.01 on Sept. 27 and Nov. 13, 2023; no Item 1.05 filing found for either (read Oct. 28, 2026). Read it online. ↩
54. SEC, "Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure," final rule, 88 FR 51896, Aug. 4, 2023, effective Sept. 5, 2023 (Form 8-K Item 1.05 compliance from Dec. 18, 2023 for most registrants; smaller reporting companies June 15, 2024; Regulation S-K Item 106) (read Oct. 28, 2026). Read it online. ↩
55. The Register, "$380M lawsuit claims intruder got Clorox's passwords from Cognizant simply by asking," July 23, 2025, on Clorox's complaint filed July 22, 2025 in California state court and Cognizant's response. Allegations, not findings. Press report (read Oct. 28, 2026). Read it online. ↩
56. SEC, Erik Gerding, Director, Division of Corporation Finance, "Disclosure of Cybersecurity Incidents Determined To Be Material and Other Cybersecurity Incidents," statement, May 21, 2024 (read Oct. 28, 2026). Read it online. ↩
57. Nucor Corp., Current Report on Form 8-K, Item 1.05, filed May 14, 2025 (date of report May 13, 2025) (read Oct. 28, 2026). Read it online. ↩
58. SEC EDGAR submissions data for Nucor (CIK 0000073309; Item 1.05 8-K May 14, 2025, amended June 20, 2025), Sensata Technologies (CIK 0001477294; Item 1.05 8-K April 9, 2025) and Stryker (CIK 0000310764; 8-K/A Item 1.05 April 9, 2026) (read Oct. 28, 2026). Read it online. ↩
59. Cherry Hill Advisory, "SEC Cybersecurity Disclosure Rule: Two Years of 8-K Filings (2026 Review)" (47 Item 1.05 and 31 voluntary Item 8.01 cyber filings, December 2023 to May 2026). Private tracker; individual entries not each checked on EDGAR (read Oct. 28, 2026). Read it online. ↩
60. Cybersecurity Dive, report on Coca-Cola's SEC disclosure of a ransomware attack that suspended production at Fairlife's U.S. facilities, July 17, 2026. Press report (read Oct. 28, 2026). Read it online. ↩
61. National Association of Manufacturers, "NAM: SEC Must Make Changes to Cybersecurity Disclosure Rule," June 18, 2025; see also the SEC's listing of the May 2025 joint petition to amend the rule and Chairman Paul Atkins's Jan. 13, 2026 statement on reviewing Regulation S-K. No amendment proposed or adopted as of Oct. 28, 2026 per a Federal Register search (read Oct. 28, 2026). Read it online. ↩
62. GOV.UK, "Government backs Jaguar Land Rover with GBP 1.5 billion loan guarantee," Sept. 28, 2025 (read Oct. 28, 2026). Read it online. ↩
63. Prolific North, report on the UK Cyber Monitoring Centre's estimate of the JLR incident's economic cost (GBP 1.9 billion; Category 3 systemic event), October 2025. Press report (read Oct. 28, 2026). Read it online. ↩
64. Tenable, "Coordinated cyberattack on Minnesota water utilities: what you need to know," 2026 (July 26 to 27, 2026 events in Braham, Plymouth, Maple Plain and other communities). Vendor summary of public reports (read Oct. 28, 2026). Read it online. ↩
65. U.S. Bureau of Labor Statistics, Current Employment Statistics, Idaho manufacturing (series SMS16000003000000001) and total nonfarm (SMS16000000000000001), seasonally adjusted, September 2026 preliminary, via the BLS Public Data API (read Oct. 28, 2026). Read it online. ↩
66. Idaho Department of Labor, "2025 Top 15 private Idaho businesses" (updated August 2026), business listings page (read Oct. 28, 2026). Read it online. ↩
67. CISA, NSA, FBI, EPA, TSA and international partners, "Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products," Jan. 13, 2025 (read Oct. 28, 2026). Read it online. ↩
68. U.S. Government Accountability Office, "Surface Transportation: TSA Is Taking Steps to Enhance Cybersecurity, but Additional Actions Are Needed," GAO-25-107947, testimony of Tina Won Sherman, Nov. 19, 2024 (read Oct. 28, 2026). Read it online. ↩