News

Reporting on industrial security incidents, vendor advisories, and threat-actor activity.

2026-07-20

Ransomware hits Fairlife LLC, suspending all US dairy production

Coca-Cola's dairy subsidiary disclosed a ransomware intrusion on July 16, 2026, that forced the suspension of all US production operations and triggered a material cybersecurity disclosure to the SEC.

Fairlife · Coca-Cola · ransomware · food and beverage · manufacturing · SEC 8-K · United States
2026-06-29

Deutsche Bahn GSM-R failure halts all German rail services for two hours

A software fault during a scheduled maintenance window on June 23 knocked out the GSM-R radio system that coordinates German train operations, halting every long-distance, regional, and commuter service across the 33,400 km network for approximately two hours. German security authorities ruled out sabotage and cyberattack; the cause was an accidental software defect compounded by a failure of automatic redundancy.

Deutsche Bahn · GSM-R · railway · transportation · Germany · software failure · ETCS · FRMCS · critical infrastructure
2026-05-24 (first published 2025-12-19)

Denmark attributes 2024 Køge waterworks attack to GRU-linked Z-Pentest; three pipes burst, roughly 500 households affected

Denmark's Defence Intelligence Service attributed a 2024 cyberattack on Tureby Alkestrup Waterworks to pro-Russian hacking group Z-Pentest on December 19, 2025. Attackers accessed an internet-exposed HMI via VNC and manipulated water pressure controls, bursting three pipes and cutting service to approximately 500 households.

Denmark · Z-Pentest · GRU · CARR · water and wastewater · nis2 · VNC · HMI · CISA AA25-343A
2026-05-16 (first published 2026-04-29)

Iran-linked CyberAv3ngers escalate Rockwell PLC campaign across US critical infrastructure

A six-agency joint advisory on April 7 confirmed Iranian-affiliated actors are disrupting US water, energy, and municipal-government PLC operations through internet-exposed Rockwell Automation devices. Follow-on research from Censys and Unit 42 has since mapped the global exposure surface and documented a sharp post-advisory spike in Iranian scanning traffic.

Iran · CyberAv3ngers · IRGC-CEC · Rockwell Automation · Allen-Bradley · PLC · water and wastewater · energy · automatic tank gauge · gas stations · CISA AA26-097A
2026-05-08

ShinyHunters breaches Instructure Canvas, exposing data across 9,000 schools and demanding ransom by May 12

The criminal extortion group ShinyHunters claimed responsibility for an April 30 breach of Instructure, the company behind the Canvas learning management system used by roughly 9,000 educational institutions worldwide. Instructure confirmed the intrusion and acknowledged that names, email addresses, student ID numbers, and user messages were taken. The group followed the data theft with a defacement campaign against school login portals on May 7 and set a May 12 ransom deadline.

ShinyHunters · Instructure · Canvas · LMS · education · data breach · extortion · supply chain
2026-05-07 (first published 2025-05-06)

Four US agencies warn oil and gas operators that unsophisticated hacktivists are inside internet-exposed ICS

A May 2025 joint advisory from CISA, the FBI, EPA, and the Department of Energy formally documented what hacktivist groups like Sector 16 and Z-Pentest had been broadcasting on Telegram since January: that US oil and gas SCADA systems reachable from the public internet are being accessed with default credentials and no bespoke tooling. A December 2025 follow-on advisory confirmed the same pattern across water, food, and energy sectors globally.

oil and gas · ICS · SCADA · hacktivist · Russia · Sector 16 · Z-Pentest · CyberAv3ngers · default credentials · VNC · CISA · OT exposure
2026-04-29

Forescout honeypot exposes how the TwoNet hacktivist group manufactured a fake water-utility victory

Forescout's April research disclosure documents a Russia-aligned hacktivist group breaking into a decoy water-treatment HMI with default credentials, immediately broadcasting the access on Telegram, and abandoning the channel within weeks. The case is rare primary evidence of the inflate-and-disappear pattern that has driven months of false ICS-attack claims.

Forescout · TwoNet · hacktivism · water and wastewater · honeypot · Russia · default credentials · Modbus · S7Comm
2026-04-29

Stryker confirms material Q1 impact from Iran-linked Intune wiper attack

Stryker's April 9 Form 8-K/A declared full operational restoration and a material hit to Q1 2026 earnings from the March 11 Handala wiper attack. The case extends the Norsk Hydro pattern of IT-driven multi-week industrial-manufacturing halts, this time delivered through abuse of Microsoft Intune cloud endpoint management.

Stryker · Handala · Iran · MOIS · Microsoft Intune · wiper · medical devices · manufacturing · SEC 8-K
2026-04-28

Itron confirms breach of corporate IT network; no OT or utility-customer systems affected

Itron, which supplies smart meters and grid-management platforms to more than 8,000 utilities across 100 countries, confirmed on April 27 that an unauthorized party accessed its internal IT network on April 13. The company found no evidence of access to the customer-hosted portion of its systems and assessed the incident as not material. The case illustrates how close a corporate IT breach can reach toward utility operational infrastructure without touching it.

Itron · smart meters · utility · supply chain · SEC 8-K · corporate IT · water and wastewater · power and utilities
2026-02-05

Romania's national oil pipeline operator Conpet hit by Qilin ransomware, 1TB data stolen

Qilin ransomware operators breached Conpet's corporate IT network on February 4, 2026, exfiltrating approximately 1TB of financial and personnel data. The company's SCADA system and telecommunications infrastructure were confirmed unaffected, and pipeline transport operations continued normally.

Romania · oil and gas · pipeline · ransomware · Qilin · RaaS · data exfiltration · nis2
2025-12-27

Romania's largest coal power producer hit by Gentlemen ransomware on Christmas Day

The Gentlemen ransomware group encrypted IT systems at Oltenia Energy Complex on December 26, 2025, disrupting ERP, email, and administrative infrastructure. Power generation continued throughout, and Romania's national energy supply was not affected.

Romania · energy · ransomware · Gentlemen · RaaS · coal · power generation · nis2
2025-12-22

Romania's national water authority hit by BitLocker ransomware; 1,000 IT systems encrypted across 10 regional offices

Administrația Națională Apele Române (Romanian Waters) suffered a BitLocker ransomware attack on December 21–22, 2025, encrypting approximately 1,000 systems including GIS servers, email, databases, and workstations across 10 of 11 regional offices. Hydrotechnical infrastructure — dams, flood defenses, and dispatch operations — was confirmed unaffected. No attacker has claimed responsibility.

Romania · water · ransomware · BitLocker · LOLBins · water management · critical infrastructure · nis2