The Challenge
In early 2025, foreign hackers breached a U.S. industrial automation company that provides system integration and engineering consulting to power utilities and transportation operators. They weren't targeting the integrator's systems but were searching for "customers" and "SCADA." They compiled about 800 files into .zip folders, setting the stage for potential attacks against critical infrastructure clients.
FBI analysts found customer SCADA information, ICS device details, and operational schematics in those folders. The hackers effectively stole a roadmap: architectural layouts, electrical diagrams, and network diagrams. With device make, model, and software version data typically maintained by integrators, adversaries have everything they need to plan precision attacks against multiple utilities.
This wasn't ransomware. The careful reconnaissance and multi-target positioning suggest a nation-state actor building capability for future disruption.
The Environment and Constraints
OT operators face a structural vulnerability: reliance on third-party integrators to design, install, and maintain SCADA and other industrial control systems. Integrators hold comprehensive technical documentation that operators often don't centralize or protect as rigorously as their own networks.
Integrators need deep access to perform their jobs. They require architectural drawings, electrical schematics, and network diagrams to configure systems and provide ongoing support. This access creates supply chain risk. If an integrator's security is weaker than the operator's, the integrator becomes the path of least resistance. Attackers can compromise the consultant who already has the blueprints.
The CISA and FBI advisory highlights this: "Critical infrastructure owners and operators that rely on third-party integrators for system design face supply chain risks" without clear security requirements.
The Approach Taken
The advisory doesn't detail the breached integrator's remediation steps but outlines what OT operators should enforce. Recommendations focus on access controls and data handling practices that operators often pay for but don't enforce.
Least privilege access: Integrators should only access systems and data necessary for their specific tasks. If troubleshooting a PLC at one substation, they shouldn't have network-wide access.
Credential management: Change default passwords on OT devices before deployment. Remote access tools should be customer-owned and monitored, not integrator-managed.
Asset inventory discipline: Operators need current documentation of what the integrator installed, where it's deployed, and what versions are running. This inventory should reside in the operator's environment.
Data residency controls: Customer SCADA information and network schematics shouldn't remain on the integrator's network after project completion. Contracts should specify retention limits and require secure deletion.
Results and Metrics
The advisory doesn't confirm whether the 800 files were exfiltrated or if downstream attacks occurred. This ambiguity is common in forensic investigations where network logs may not capture completed data transfers. The 18-month gap between the breach and the advisory suggests the FBI and CISA prioritized understanding the threat pattern before issuing guidance. The tone indicates no active campaign is underway, but operators are alerted to a proven tactic.
What They Would Do Differently
The advisory points to a contracting gap. Many operators have agreements that include asset inventory updates, credential rotation, and access logging, but they don't enforce these provisions or audit compliance. Integrators may not realize the operator expects certain practices, and operators may not know what they're paying for.
Before negotiating new security requirements, operators should review existing contracts. If agreements cover password management or asset documentation, integrators shouldn't charge separately for these services. If remote access tools are customer-owned, operators should actively monitor them.
Where contracts are silent, operators need explicit language on data handling: what customer information the integrator can retain, where it's stored, who can access it, and when it must be deleted. Right to Audit clauses should cover not just the integrator's work product but also their security posture.
Takeaways for Your Team
Audit your integrator contracts now. Review support agreements for your SCADA integrators. Identify security practices you're paying for but not enforcing. Hold the integrator to these terms before scoping additional work.
Treat integrator access as supply chain risk. Your integrator's network security becomes your network security when they hold your architectural diagrams and device configurations. Ensure they meet security standards.
Specify data residency and retention. Your SCADA details shouldn't reside on the integrator's server indefinitely. Contracts should state what data the integrator can keep and when it must be securely deleted.
Own your remote access tools. Deploy a customer-owned platform for remote access that you monitor. Avoid integrator-managed remote access that creates exposure you can't control.
Require sub-processor disclosure. If your integrator uses subcontractors or cloud hosting, you need visibility into who else accesses your data. Sub-Outsourcing Clauses should require advance notice and give you the right to object.
The hackers weren't after the integrator. They wanted the downstream targets the integrator could unlock. Your team's job is to close that pathway before someone uses it.
