What Recent Operational Technology Cyber Incidents Mean for Critical Infrastructure Resilience

What Recent Operational Technology Cyber Incidents Mean for Critical Infrastructure Resilience
August 20, 2026 5 mins

What Recent Operational Technology Cyber Incidents Mean for Critical Infrastructure Resilience

From Control Room to Crisis: What Recent Operational Technology Cyber Incidents Mean for Critical Infrastructure Resilience

Recent attacks on water systems across multiple states in the U.S. highlight the potential for real operational disruptions, requiring organizations to reevaluate their operational exposure, implement targeted controls and build cyber resilience strategies.

Key Takeaways
  1. Poor network design and segregation are exposing operational technology to the internet, leaving critical infrastructure vulnerable to cyber attacks.
  2. Compromised programmable logic controllers and human-machine interfaces can quickly translate into real-world service disruptions.
  3. The severity of the threat underscores the need for critical infrastructure entities to treat operational technology cyber security as a strategic risk, supported by targeted controls and tailored risk management strategies.

Cyber Attacks on Water Systems

In late July, multiple cyber attacks targeting operational technology (OT) were reported across the United States. Confirmed intrusions generally involved technology that water systems used to remotely monitor and control equipment, such as programmable logic controllers (PLCs) and human-machine interfaces (HMIs).

According to the Federal Bureau of Investigation and Environmental Protection Agency, several of these cyber incidents led to operational disruptions, including loss of water pressure and flooding. After gaining remote access to internet-facing devices, malicious cyber actors changed their IP address and passwords. This resulted in a loss of monitoring and control functionality and, ultimately, degraded water system performance.

The investigation remains ongoing, and no formal attribution has been announced. Some public reporting1 has discussed possible links to external threat actors.

Similar cyber attacks against OT systems in the water sector were reported2 across multiple locations in the U.S. and Israel throughout 2023 and 2024 and in Europe3 in 2025. While the water sector has made the headlines, government authorities continue to warn4 of cyber threats targeting internet-connected OT used across all critical infrastructure sectors.

Recommended Actions

Safeguard and Stabilize

To strengthen resilience against cyber threats to operational technology, organizations should harden their control environments and strengthen their oversight.

  • 1. Inventory and Restrict Direct Internet Exposures

    Take inventory and identify all internet connected PLCs, HMIs and related devices, and restrict direct internet exposure by removing public access where possible and routing any necessary remote access through managed gateways or jump hosts with multi-factor authentication (MFA). Organizations should also audit remote access pathways, validate that safety systems and alarms are functioning as intended, and maintain offline backups and “known good” baselines of PLC logic so that configurations can be quickly verified and restored.

  • 2. Strengthen Separation and Oversight

    Once the immediate risks are addressed, organizations should focus on medium-term improvements that strengthen the separation and oversight of their OT environment. This includes segregating IT and OT networks with strict communication controls and firewalls and monitoring engineering workstations so that only authorized personnel can modify PLC code, with all activity logged and alerts generated for unauthorized change, including anomalies targeted to indicate intentional or non-intentional insider threat risk. Organizations should also maintain a comprehensive OT asset inventory, identify unsupported or unpatched systems, develop vulnerability and patch management processes, and tighten vendor access controls through MFA.

Strengthen and Strategize

In the long term, organizations should focus on strategic review and resilience planning.

  • 1. Review Risk and Resilience Posture

    Conduct a holistic review of the organization’s OT risk profile, including the current control environment, governance model, incident response arrangements and communication frameworks. This review should assess not only technical security posture, but also the potential financial, reputational, operational and public service impacts of an OT cyber incident.

  • 2. Model Realistic OT Loss Scenarios

    Reviewing OT controls through the lens of realistic loss scenarios can help move the conversation from technical vulnerability to enterprise exposure. Scenarios such as loss of operational visibility, unauthorized changes to control logic, forced manual operations, service interruption, equipment damage or downstream impacts to customers can reveal where existing controls may fall short under stress. This approach enables leadership to prioritize investment based on material risk, quantify potential financial and operational impacts and test the adequacy of response plans.

  • 3. Review Insurance Alignment

    Work with your insurance broker and insurers to review cyber policy language and confirm that coverage aligns with the organization’s specific OT risk profile. Closely assess coverage for cyber event management, data recovery, hardware replacement (including OT systems), business interruption and relevant exclusions, including war and public utility exclusions. For public entities, understand available coverage at the municipality, county or state level, and evaluate alternative insurance structures such as pooling agreements to negotiate stronger terms.

    Given the potential for disruptive impacts on public services, organizations should also develop and rehearse an incident response playbook for OT events that covers rapid isolation of affected devices, manual operations and clear communication protocols. Cyber insurance policies offer a variety of services that can help organizations prepare for and respond to a cyber incident.

Let’s Connect

Engage With Your Broker

Speak to your Aon contact to activate support or request more information.

Contact Us

1 Did Iran hack water systems in at least seven US states?, BBC News
2 A brief timeline of Iranian cyberattacks on U.S. companies, political figures, water systems and more, CBS News
3 Russian hackers seized control of Norwegian dam, spy chief says, The Guardian 
4 Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure, America's Cyber Defense Agency

General Disclaimer

This document is not intended to address any specific situation or to provide legal, regulatory, financial, or other advice. While care has been taken in the production of this document, Aon does not warrant, represent or guarantee the accuracy, adequacy, completeness or fitness for any purpose of the document or any part of it and can accept no liability for any loss incurred in any way by any person who may rely on it. Any recipient shall be responsible for the use to which it puts this document. This document has been compiled using information available to us up to its date of publication and is subject to any qualifications made in the document.

Terms of Use

The contents herein may not be reproduced, reused, reprinted or redistributed without the expressed written consent of Aon, unless otherwise authorized by Aon. To use information contained herein, please write to our team.

Aon's Better Being Podcast

Our Better Being podcast series, hosted by Aon Chief Wellbeing Officer Rachel Fellowes, explores wellbeing strategies and resilience. This season we cover human sustainability, kindness in the workplace, how to measure wellbeing, managing grief and more.

Aon Insights Series Asia

Expert Views on Today's Risk Capital and Human Capital Issues

Aon Insights Series Pacific

Expert Views on Today's Risk Capital and Human Capital Issues

Aon Insights Series UK

Expert Views on Today's Risk Capital and Human Capital Issues

Client Trends 2025

Better Decisions Across Interconnected Risk and People Issues.

Construction and Infrastructure

The construction industry is under pressure from interconnected risks and notable macroeconomic developments. Learn how your organization can benefit from construction insurance and risk management.

Cyber Resilience

Our Cyber Resilience collection gives you access to Aon’s latest insights on the evolving landscape of cyber threats and risk mitigation measures. Reach out to our experts to discuss how to make the right decisions to strengthen your organization’s cyber resilience.

Employee Wellbeing

Our Employee Wellbeing collection gives you access to the latest insights from Aon's human capital team. You can also reach out to the team at any time for assistance with your employee wellbeing needs.

Environmental, Social and Governance Insights

Explore Aon's latest environmental social and governance (ESG) insights.

Q4 2023 Global Insurance Market Insights

Our Global Insurance Market Insights highlight insurance market trends across pricing, capacity, underwriting, limits, deductibles and coverages.

Global Risk Management Survey

Better Decisions Across Interconnected Risk and People Issues.

Regional Results

How do the top risks on business leaders’ minds differ by region and how can these risks be mitigated? Explore the regional results to learn more.

Impact Report 2025

Explore Aon's corporate sustainability impact and strategy.

Top 10 Global Risks

Trade, technology, weather and workforce stability are the central forces in today’s risk landscape.

Industry Insights

These industry-specific articles explore the top risks, their underlying drivers and the actions leaders are taking to build resilience.

Human Capital Analytics

Our Human Capital Analytics collection gives you access to the latest insights from Aon's human capital team. Contact us to learn how Aon’s analytics capabilities helps organizations make better workforce decisions.

Human Capital Quarterly Insights Briefs

Read our collection of human capital articles that explore in depth hot topics for HR and risk professionals, including using data and analytics to measure total rewards programs, how HR and finance can better partner and the impact AI will have on the workforce.

Insights for HR

Explore our hand-picked insights for human resources professionals.

Workforce

Our Workforce Collection provides access to the latest insights from Aon’s Human Capital team on topics ranging from health and benefits, retirement and talent practices. You can reach out to our team at any time to learn how we can help address emerging workforce challenges.

Mergers and Acquisitions

Our Mergers and Acquisitions (M&A) collection gives you access to the latest insights from Aon's thought leaders to help dealmakers make better decisions. Explore our latest insights and reach out to the team at any time for assistance with transaction challenges and opportunities.

Natural Resources and Energy Transition

The challenges in adopting renewable energy are changing with technological advancements, increasing market competition and numerous financial support mechanisms. Learn how your organization can benefit from our renewables solutions. 

Navigating Volatility

How do businesses navigate their way through new forms of volatility and make decisions that protect and grow their organizations?

Parametric Insurance

Our Parametric Insurance Collection provides ways your organization can benefit from this simple, straightforward and fast-paying risk transfer solution. Reach out to learn how we can help you make better decisions to manage your catastrophe exposures and near-term volatility.

Pay Transparency and Equity

Our Pay Transparency and Equity collection gives you access to the latest insights from Aon's human capital team on topics ranging from pay equity to diversity, equity and inclusion. Contact us to learn how we can help your organization address these issues.

Property Risk Management

Forecasters are predicting an extremely active 2024 Atlantic hurricane season. Take measures to build resilience to mitigate risk for hurricane-prone properties.

Technology

Our Technology Collection provides access to the latest insights from Aon's thought leaders on navigating the evolving risks and opportunities of technology. Reach out to the team to learn how we can help you use technology to make better decisions for the future.

Trade

Our Trade Collection gives you access to the latest insights from Aon's thought leaders on navigating the evolving risks and opportunities for international business. Reach out to our team to understand how to make better decisions around macro trends and why they matter to businesses.

Transaction Solutions Global Claims Study

Better Decisions Across Interconnected Risk and People Issues.

Weather

With a changing climate, organizations in all sectors will need to protect their people and physical assets, reduce their carbon footprint, and invest in new solutions to thrive. Our Weather Collection provides you with critical insights to be prepared.

Workforce Resilience

Our Workforce Resilience collection gives you access to the latest insights from Aon's Human Capital team. You can reach out to the team at any time for questions about how we can assess gaps and help build a more resilience workforce.

More Like This

View All
  • SMRs: Advancing Energy Security and Decarbonization

    Article 5 mins

    SMRs: Advancing Energy Security and Decarbonization

    As investment in small modular reactors accelerates, project success will depend on more than technology. Early attention to risk, insurance and regulatory certainty can help improve insurability, support financing and accelerate deployment.

  • Managing Data Center Accumulation Risk

    Article 10 mins

    Managing Accumulation Risk in Data Centers

    Data centers today, driven by growth and scale, concentrate enough value for a single event to create a portfolio-level loss. Re/insurers and captives that understand and manage aggregation exposure will be better positioned to sustain capacity and support long-term sector growth.

View All