Volt Typhoon intrusion into Littleton Electric Light and Water Departments OT network

Between February and November 2023, Chinese state-sponsored hackers attributed to Volt Typhoon maintained persistent access to the network of Littleton Electric Light and Water Departments (LELWD), a municipal electric and water utility serving Littleton and Boxborough, Massachusetts. LELWD later stated that the targeting appeared linked to a firewall with a known flaw that its then-managed service provider had not patched. The FBI notified LELWD shortly before Thanksgiving 2023 that the actor had been present for roughly 10 months. FBI and CISA representatives visited the facility during the response. Dragos later published a named-victim case study on the intrusion, describing VOLTZITE activity, SMB traversal, RDP lateral movement, and activity close to OT visibility and monitoring systems. Public reporting based on Dragos and law-enforcement context described exfiltration of OT operating procedures and energy-grid spatial layout data. The public sources reviewed do not support a stronger claim that the actor fully pivoted into OT control systems or exfiltrated LELWD-specific GIS and network configuration files. LELWD terminated the managed service provider, removed the actor, changed network architecture, and later completed a CISA-assisted penetration test. No public safety impact or customer-sensitive data compromise was reported, and no service disruption was reported in the reviewed sources. The significance of the incident is pre-positioning and OT-relevant reconnaissance rather than immediate sabotage, matching the Volt Typhoon pattern described in US and Five Eyes advisories on Chinese access to critical infrastructure.

No public safety impact, customer-sensitive data compromise, or electric and water service disruption was reported for LELWD's approximately 8,000 electric customers and 4,000 water customers. The operational impact was strategic: attackers collected OT-relevant procedures and electric-grid layout information, prompting CISA-assisted remediation and network architecture changes. Financial impact was not publicly disclosed.