2026 OT Threat Report Finds Physical-Impact Cyber Incidents Fell 25% in 2025
Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.
Summary
Waterfall and ICS STRIVE recorded 57 cyber incidents with physical consequences in 2025, down from 76 in 2024. Nation-state and hacktivist incidents doubled, while limited public disclosures hindered analysis of operational impacts.
Key points
- The report counts deliberate, publicly disclosed cyberattacks causing physical consequences in industrial operations, including IT breaches that disrupt production; its authors caution that the dataset undercounts actual activity.
- Recorded incidents fell 25% to 57 in 2025. The authors link the decline primarily to an apparent plateau or reduction in ransomware activity, but caution against assuming it will persist.
- Nation-state and hacktivist incidents doubled to 14; the report links five to Russia’s invasion of Ukraine.
- Public disclosures lacked enough detail to determine how attacks impaired physical operations in 65% of cases, preventing meaningful analysis of those mechanisms for 2025.
- Jaguar Land Rover’s UK factories stopped production for over a month following an apparent ransomware attack, while ransomware affecting Collins Aerospace’s vMUSE system caused airport disruption lasting up to 16 days.
- A December 2025 attack attributed to Russian actors targeted more than 30 Polish wind and solar sites and damaged control equipment. Electricity and heat continued flowing, so the report excluded this near miss from its incident totals.
- Recommendations include removing direct internet exposure from OT assets, strengthening IT/OT boundaries, planning for essential IT dependencies, and maintaining tested recovery or manual fallback procedures.
Article Details
- Publisher
- Waterfall Security Solutions and ICS STRIVE
- Report Period
- 2025-01-01/2025-12-31
- Scope
- Publicly disclosed deliberate cyber attacks causing physical consequences in manufacturing, building automation, heavy industry, critical industrial infrastructure, and transportation, including attacks affecting only IT assets.
- Sample Size
- 57 incidents meeting the research team's high-confidence inclusion criteria; a conservative underestimate of actual activity. The Polish distributed-generation near miss was excluded.
- Key Statistics
- Qualifying incidents declined by 25%, from 76 in 2024 to 57 in 2025.
- Nation-state and hacktivist attacks doubled to 14 in 2025; five were clearly linked to Russia's invasion of Ukraine.
- For 65% of public incident reports in 2025, insufficient detail was available to determine how the cyber attack impaired physical operations.
- The 2025 incident dataset covered 21 nations.
- Transportation accounted for 14 breaches (25%); Oil & Gas, Water & Wastewater, Electric Power, and Metals & Mining together accounted for another seven breaches (12%).
- Recommendations
- Immediately disconnect Internet-exposed control-system assets from the Internet.
- Strengthen IT/OT boundaries using hardware-enforced protections and remote access where appropriate, and identify and address OT dependencies on IT systems and services.
- Require evidence of rapid recovery capabilities or practiced manual fallback procedures for critical third-party, cloud-based, and highly distributed systems.
- Address large-scale device-bricking risk by upgrading equipment that cannot be replaced like-for-like or deploying defenses strong enough to counter credible destructive attacks.
- Adopt Cyber-Informed Engineering and the new multi-agency OT connectivity guidance, including engineering-grade controls, connectivity monitoring, and isolation planning.
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolAttackers accessed Mikronika HMI Windows computers via RDP before running a destructive wiper.T1078.001 · Default AccountsAttackers used a default FTP account on Hitachi Relion 650 relays and default credentials on Moxa NPort devices during the Polish energy attack.T1485 · Data DestructionIn the Polish energy attack, attackers attempted to remove Linux filesystem contents, deleted essential relay files, and ran a wiper on HMI computers.T1486 · Data Encrypted for ImpactThe report describes ransomware encryption of IT environments, including an attack said to have encrypted over 1,000 computers supporting Collins Aerospace operations.T1495 · Firmware CorruptionAttackers loaded corrupted firmware onto Hitachi RTU560 devices, causing reboot loops; the report also describes erased automation-device firmware.T1566 · PhishingThe Jaguar / LandRover dataset entry describes phishing and social engineering used to steal credentials and compromise the IT network.
People
Threat Actors
ELECTRUMDragos identified this Russian group as the adversary behind the Polish energy-infrastructure attack; the report says it did not produce new ICS-specific malware for that attack.IT Army of the UkraineClaimed responsibility for DDoS attacks disrupting Russian animal-product certification and tracking systems in June and October 2025.LynxThe dataset identifies this ransomware group as having compromised Stürmer Maschinen, delaying deliveries.NoName057(16)Described as a pro-Russian group that claimed responsibility for a DDoS attack disrupting La Poste parcel deliveries.QilinThe incident dataset attributes ransomware attacks against Lee Enterprises and Wibaie à Cholet to this group.Scattered LapsusThe dataset attributes the Jaguar / LandRover ransomware incident to this group.Silent CrowDescribed as pro-Ukrainian hackers who claimed to have erased 7,000 Aeroflot IT servers; the dataset records associated flight cancellations and delays.WarlockClaimed responsibility for the ransomware attack associated with Tein Inc. factory outages in Japan and China.
Malware
Vendors
Collins Aerospace- **Collins Aerospace**: A crippled software-based system caused flight cancellations and delays for weeks – highlighting the need for rapid recovery or manual fall-backs for critical systems operated and managed byHitachi| | | | | | | | • Hitachi | RTU560 | | – | loaded | | corrupted | |Mikronika| | | | | | | | • Mikronika | | RTUs | – | logged | | into | the |Moxa| • Moxa | NPort | 6xxx | Serial | | Device | Servers | – | | | | | | | |
Products
Countries
CanadaHistorically, the USA, Germany and Canada have rotated through the “top 3” victim geographies.GermanyHistorically, the USA, Germany and Canada have rotated through the “top 3” victim geographies.Iran- **Iran’s air defenses** – an American military cyber attack prevented Iran from launching surface-to-air missiles when American warplanes entered Iranian airspace, as part of a mission to bomb nuclear weaponsJapan2025 -09-02 Bridgestone Japan Unknown shut down for 16 industrialcyber.coNorway| in Norway | and | stopped | | production | | at a | summary | : | | | | | | |Poland| small hydro | -power | plant | in Poland, | | both | by | | | | | | | | |Russia- **Russia’s Mercury / VetIS / Saturn systems** – for tracking the movement of animal products for human consumption – were twice crippled by DDoS attacks. Some Russian meat-packing plants needed these raw products toUkraineNation-state and hacktivist attacks doubled in 2025 over 2024, with 5 of the 14 attacks clearly linked to the kinetic conflict which is the Russian invasion of Ukraine.United Kingdom| ransomware | | shut | down JLR | UK factories | | | for | | | | | | | | |United StatesHistorically, the USA, Germany and Canada have rotated through the “top 3” victim geographies.
Industries
discrete manufacturingPower plants, refineries and pipeline operators for example, tend to track incidents in pharmaceuticals, discrete manufacturing, and shipping, because they see themselves as similar kinds of targets.Metals & MiningPower and Metals & Mining . This is in included Oil & Gas, Water Systems, Power,Oil and gasOil & Gas, Water & Wastewater, Electric breached with physical consequencesTransportation- Impact manufacturing, building automation, heavy industry, and critical industrial infrastructures, including the transportation of people and goods,Water and wastewaterOil & Gas, Water & Wastewater, Electric breached with physical consequences