Warning on Cyber Vulnerabilities in Operational Technology Environments
By Shaun Waterman
Date: September 25, 2026
In a significant advisory issued recently, U.S. authorities have alerted companies utilizing operational technology (OT) about the potential cybersecurity risks associated with granting access to third-party integrators and consultants. This warning emphasizes the need for vigilance and robust security measures in light of increasing cyber threats that exploit these external connections. The advisory, jointly released by the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI, outlines the serious implications of unsecured networks, particularly for organizations within critical infrastructure sectors.
The advisory indicates that operational technology systems are increasingly targeted by foreign hackers. These cybercriminals often exploit online access provided to third-party service providers. Such access can inadvertently create pathways for unauthorized incursions into essential systems and networks. The report underscores that operators relying on third-party integrators must be acutely aware of the supply chain risks involved when these companies are not held to stringent security standards.
Concrete evidence highlights that the risks portrayed in the advisory are not merely hypothetical. A troubling incident from March to April 2025 illustrated the increasing audacity and sophistication of cyber threats. During this period, malicious foreign actors breached the network of a U.S. company specializing in industrial automation solutions. This company provided system integration and engineering consulting services across various sectors, including power utilities and transportation systems. The company had a particular focus on supervisory control and data acquisition (SCADA) systems, essential for the remote management and monitoring of industrial machinery.
Upon investigation, FBI technical analysts discovered that the attackers conducted queries looking for sensitive terms like “customers” and “SCADA,” gathering about 800 files into compressed folders, likely preparing for data exfiltration. While the advisory does not confirm whether these files were actually stolen, it is documented that they included critical information—customer SCADA details, precise device specifications, and schematics. This data, if successfully intercepted, could potentially enable hackers to orchestrate disruptive attacks against the company’s clientele, posing significant risks to vital services.
Patrick Gillespie, an expert in industrial systems security and the OT Practice Director at GuidePoint Security, remarked that the data the hackers were attempting to secure effectively served as a "roadmap" for future cyberattacks. According to him, integrators usually design systems with comprehensive blueprints, including architectural, electrical, and network diagrams. Such detailed schematics are vital for the installation of machinery like conveyor belts, which require precise knowledge of the physical layout, electrical needs, and network infrastructure.
This meticulous data-gathering approach, targeting an integrator to facilitate downstream attacks on various critical services, characterizes the methodology of highly sophisticated threat actors, likely state-sponsored, as indicated by Michael Garcia. Garcia, who previously served as the associate policy chief at CISA and is now the policy director for the Operational Technology Cybersecurity Coalition, noted that a typical cybercriminal would often resort to simpler tactics, such as data encryption followed by extortion, rather than engaging in extensive reconnaissance.
The tone of the advisory suggests that the agencies do not perceive an immediate, ongoing threat. Garcia interpreted the cautious verbiage of the advisory as indicative of the understanding that this tactic, though concerning, is not part of an active campaign. He remarked that the advisory’s timing, occurring 18 months after the cyber breach incident, raises questions about the factors that prompted its release, including potential undercover operations by the FBI.
In response to these emerging threats, the advisory highlights foundational security measures that organizations should adopt. Among these measures, the principle of "least privilege," which limits access to essential personnel only, is crucial. Furthermore, companies are encouraged to thoroughly review their support contracts with third-party integrators, determining whether the recommended precautions, such as conducting an asset inventory or updating default passwords, are already encompassed within their existing agreements.
While establishing robust security protocols is vital, Gillespie notes that certain recommendations may necessitate further tailored strategies. For example, if a customer utilizes a proprietary remote access tool, the integration of security measures may require distinct project considerations.
The advisory by CISA and the FBI embodies a proactive approach to enhancing cybersecurity within critical infrastructure sectors, encouraging companies to be vigilant and proactive in safeguarding their operational technology environments from increasing cyber threats. As these events unfold, the intersection of cybersecurity and critical infrastructure remains a focal point, reinforcing the necessity for ongoing vigilance, robust communication, and comprehensive security practices.