Attacks on grids and water systems feature in most doomsday talk. Agencies do document real activity, but the confirmed record is more modest and more fixable than the headlines suggest.
What is documented
Hacktivist intrusions. CISA advisory AA25-343A (9 December 2025, revised 18 December 2025), written with the FBI, NSA and international partners, says pro-Russia groups attack operational technology, mainly through internet exposed VNC connections to HMI devices, in water and wastewater, food and agriculture, and energy. The agencies assess the groups as less sophisticated than advanced persistent threats. They say attacks can cause "varying degrees of impact, including physical damage," that the groups "regularly make false or exaggerated claims," and that the most common reported impact is a "temporary loss of view" forcing manual operation. The advisory says attacks have not yet caused injury.
State prepositioning. CISA advisory AA24-038A (7 February 2024) assesses that PRC state sponsored actors, tracked as Volt Typhoon, seek to "pre-position themselves on IT networks for disruptive or destructive cyberattacks" in a major crisis or conflict. It reports access maintained "for at least five years" in some victim IT environments, across communications, energy, transportation and water.
Grid adequacy. Separate from cyber risk, reporting on NERC's 2025 Long-Term Reliability Assessment says 13 of 23 North American areas face elevated or high resource adequacy risk, driven by demand growth. That is a capacity issue, not an attack.
Not documented: a confirmed plan or date for a large scale grid takedown.
How to check if you're exposed
- Scan your public IP ranges for VNC, RDP and HMI web interfaces.
- Check for default or shared credentials on controllers.
- Confirm whether any remote access path skips MFA.
What to do now
- Remove OT devices from the public internet, or place access behind a VPN with MFA and default deny rules.
- Segment IT and OT with a DMZ.
- Keep an asset inventory with data flows.
- Set remotely accessible accounts to view only where possible.
- Back up HMI logic and configurations, and practise manual operation.
How this could have been avoided
- Internet exposed VNC with weak passwords is the common entry, so removing exposure and enforcing MFA closes it.
- Alerts on setpoint drift catch manipulated parameters.
- Tested manual procedures turn a loss of view into an inconvenience.
Why it matters
Most OT incidents documented here come from basic exposure, not exotic exploits. Basic hygiene reduces most of the realistic risk.
Try it yourself
Use the asset discovery walkthrough to see what an inventory of exposed systems looks like.
Click through it at your own pace, or open it full screen.
Quick check
What is the most common impact the agencies report from hacktivist OT attacks?
A temporary loss of view, which forces operators to work manually.
Do the agencies say the groups are highly sophisticated?
No. They assess them as less sophisticated than advanced persistent threat actors, while warning that harm is real.
