Post-incident guidance that leads with the exposed device rather than the adversary. For a utility with one engineer, that is the usable document.
More than 30 Minnesota communities disrupted through internet-facing controllers. Manual operation was the fallback, and it is a capability most utilities are losing.
Fifteen filings is fifteen more than exist for most industries here. The level is uninformative; the trend will not be.
A contractor breach adds a route that segmentation does not address, because the contractor’s access is legitimate by design.
A small municipal utility has the operational exposure of critical infrastructure and the budget of a town department — and no route into the record.
Response cost and extortion demand are different quantities. The phrase “the attack cost £4.5m” invites the error of treating them as one.
A resident who needs to pay a water bill has one counterparty and no alternative.
No CVE. The controller was on the internet with the password it shipped with.