# Hackopedia by BlastWave

> Hackopedia, published by BlastWave, is a sourced record of 50 cyber incidents affecting industrial, infrastructure and other physical operations. Each entry grades every claim as verified, reported or undisclosed and cites its sources.

Statements labelled "BlastWave analysis" are interpretation, not disclosed fact. Cite entry pages, not this file.

## Start here
- [What Hackopedia is for](https://hackopedia.blastwave.com/about/): the introduction to Volume 2.
- [Stuxnet](https://hackopedia.blastwave.com/stuxnet-2010/): what is shown and what is believed, and how to read an entry.

## Water edition
- [Water edition overview](https://hackopedia.blastwave.com/water/): Hackopedia's Water edition covers nine OT incidents at water, wastewater and dam operations from 2013 to 2026, from the Bowman Avenue Dam intrusion to the July 2026 controller lockouts. Several of the most repeated stories are weaker than their headlines: one target was a research decoy, one is a malware sample with no victim, and Oldsmar remains contested.
- [Oldsmar Water Treatment Plant Incident (2021)](https://hackopedia.blastwave.com/water/oldsmar-2021/): FILE 005. A sodium hydroxide setpoint was raised 111-fold and reversed within minutes; the FBI later said it could not confirm a targeted intrusion.
- [Bremanger Dam Intrusion (2025)](https://hackopedia.blastwave.com/water/bremanger-dam-2025/): FILE 018. Someone with remote access opened a dam's minimum flow valve fully; the access lasted just under four hours, the dam feeds a fish hatchery, and nothing flooded.
- [Bowman Avenue Dam Intrusion (2013)](https://hackopedia.blastwave.com/water/bowman-avenue-2013/): FILE 019. An intruder read a flood-control dam's water levels and gate status for three weeks; the gate had been disconnected for maintenance.
- [American Water Cyber Incident (2024)](https://hackopedia.blastwave.com/water/american-water-2024/): FILE 021. Unauthorized activity on the corporate network took billing and the customer portal offline for about a week; the company never called it ransomware.
- [US Water Utility PLC Intrusions (2026)](https://hackopedia.blastwave.com/water/us-water-campaign-2026/): FILE 024. Internet-exposed water utility controllers were locked out; pressure loss and flooding were reported, and no government has said who.
- [CyberAv3ngers Unitronics Campaign and Aliquippa Water Incident (2023)](https://hackopedia.blastwave.com/water/cyberav3ngers-2023/): FILE 025. IRGC-affiliated actors using the CyberAv3ngers persona defaced internet-facing Unitronics controllers; the federal count is of devices, not utilities.
- [Attempted Cyberattack on Israeli Water Systems (2020)](https://hackopedia.blastwave.com/water/israeli-water-2020/): FILE 026. Israel said an attempted attack on water control systems was handled with no harm to supply; the chlorine plot rests on unnamed officials.
- [TwoNet Water Plant Honeypot Intrusion (2025)](https://hackopedia.blastwave.com/water/twonet-water-honeypot-2025/): FILE 027. A hacktivist group defaced a decoy plant, changed setpoints and disabled alarms, then claimed a real-world attack.
- [ZionSiphon Malware (2026)](https://hackopedia.blastwave.com/water/zionsiphon-2026/): FILE 044. Code aimed at Israeli water and desalination plants whose own country check fails; Dragos says it lacks ICS capability.

## Oil and Gas edition
- [Oil and Gas edition overview](https://hackopedia.blastwave.com/oil-and-gas/): Hackopedia's Oil and Gas edition covers eight incidents from 2012 to 2025, from the Shamoon wiper at Saudi Aramco to Colonial Pipeline. The record places attackers on operational technology at a refinery's safety controllers (Triton), at a US gas compression facility and, per one vendor, at pipeline engineering workstations. At Colonial, the operator stopped the pipeline itself.
- [Colonial Pipeline Ransomware Attack (2021)](https://hackopedia.blastwave.com/oil-and-gas/colonial-pipeline-2021/): FILE 001. A ransom note on the business network led Colonial's own control center to stop the pipeline in about fifteen minutes; it was fully operational on 17 May.
- [Triton / TRISIS Safety System Attack (2017)](https://hackopedia.blastwave.com/oil-and-gas/triton-2017/): FILE 004. An attacker tried to reprogram a refinery's Triconex safety controllers; they failed safe, and the Justice Department says the plant went through two automatic emergency shutdowns.
- [US Natural Gas Compression Facility Ransomware Incident (Disclosed 2020)](https://hackopedia.blastwave.com/oil-and-gas/us-gas-compression-2020/): FILE 007. Ransomware moved from IT into OT and encrypted operator screens, historians and polling servers; no controller was affected, and the operator chose to shut down for about two days.
- [CPC Corporation Taiwan Ransomware Attack (2020)](https://hackopedia.blastwave.com/oil-and-gas/cpc-corporation-taiwan-2020/): FILE 022. Ransomware reached more than 7,500 office computers by a reported official count; by CPC's account, production was not damaged and fuel supply never stopped.
- [Shamoon Wiper Attack on Saudi Aramco (2012)](https://hackopedia.blastwave.com/oil-and-gas/shamoon-2012/): FILE 029. The Shamoon wiper erased about 30,000 workstations on Aramco's business network; Aramco said oil production never stopped, a claim never independently audited.
- [Halliburton Cybersecurity Incident (2024)](https://hackopedia.blastwave.com/oil-and-gas/halliburton-2024/): FILE 034. An unauthorized third party reached business applications and took information; Halliburton reported $35 million of expenses, not a loss.
- [Pipedream (Incontroller) ICS Malware Toolkit Disclosure (2022)](https://hackopedia.blastwave.com/oil-and-gas/pipedream-2022/): FILE 042. Four US agencies published tools to seize Schneider and Omron controllers and OPC UA servers; no use against any victim is recorded.
- [KAMACITE and VOLTZITE OT Threat Activity (2025)](https://hackopedia.blastwave.com/oil-and-gas/kamacite-voltzite-2026/): FILE 050. Dragos reported one group scanning US industrial devices and another reaching pipeline engineering workstations; no attack, victim or attribution is on the record.

## Manufacturing edition
- [Manufacturing edition overview](https://hackopedia.blastwave.com/manufacturing/): Hackopedia's Manufacturing edition covers twelve incidents from 2014 to 2026, from an unnamed German steelworks to West Pharmaceutical. Only the steelworks entry records physical damage to plant, reported by Germany's BSI. In many of the others, production stopped after the company shut down or isolated its own systems, and several widely quoted cost figures are not costs.
- [German Steel Mill Cyberattack (Disclosed 2014)](https://hackopedia.blastwave.com/manufacturing/german-steel-mill-2014/): FILE 008. Attackers phished into an unnamed steelworks and reached its production networks; a blast furnace could not be shut down in a controlled manner, the BSI reported.
- [Norsk Hydro Ransomware Attack (2019)](https://hackopedia.blastwave.com/manufacturing/norsk-hydro-2019/): FILE 010. Ransomware spread across the aluminum maker's IT; plants were isolated, some ran with more manual work, and Hydro estimates the total cost at around NOK 800 million.
- [Toyota Plant Shutdown After Kojima Industries Ransomware Attack (2022)](https://hackopedia.blastwave.com/manufacturing/toyota-2022/): FILE 013. A system failure at supplier Kojima Industries, hit by ransomware, stopped all 28 lines at Toyota's 14 plants in Japan for one day; no record says a Toyota system was hacked.
- [Bridgestone Americas Cyber Incidents (2022 and 2025)](https://hackopedia.blastwave.com/manufacturing/bridgestone-2022/): FILE 014. Plants were disconnected in 2022 to contain ransomware, and some stopped again in 2025 after a "limited cyber incident"; nothing shows a shared cause.
- [Ingersoll Rand Cybersecurity Incident (2023)](https://hackopedia.blastwave.com/manufacturing/ingersoll-rand-2023/): FILE 015. An incident disrupted several IT systems; the company later called it not material and has never disclosed the vector, the actor or any effect on production.
- [Nucor Cyber Incident and Production Halt (2025)](https://hackopedia.blastwave.com/manufacturing/nucor-2025/): FILE 016. Unauthorized access to IT systems led North America's largest steel producer to halt production at various locations "in an abundance of caution"; it called the incident not material.
- [Jaguar Land Rover Cyber Incident (2025)](https://hackopedia.blastwave.com/manufacturing/jaguar-land-rover-2025/): FILE 023. Global systems were shut down and UK vehicle production stopped for about five weeks; how the attackers got in has never been officially stated.
- [Clorox Cyberattack (2023)](https://hackopedia.blastwave.com/manufacturing/clorox-2023/): FILE 036. An intrusion forced manual order processing and paused production; the quoted $356M is a sales decline, and the disclosed cost was $49M through December 2023.
- [MKS Instruments Ransomware Incident (2023)](https://hackopedia.blastwave.com/manufacturing/mks-instruments-2023/): FILE 037. Ransomware on business systems halted ordering and shipping at a chip-equipment supplier; the quoted $200M was expected lost revenue, the disclosed cost $15M net.
- [West Pharmaceutical Cyberattack (2026)](https://hackopedia.blastwave.com/manufacturing/west-pharmaceutical-2026/): FILE 039. Data was exfiltrated and unnamed systems encrypted; West took its systems offline worldwide, and all sites restarted by 20 May.
- [Stryker Cybersecurity Incident (2026)](https://hackopedia.blastwave.com/manufacturing/stryker-2026/): FILE 040. An intrusion into the corporate network disrupted order processing, manufacturing and shipping; nothing on the record says a production machine was reached.
- [Johnson Controls Ransomware Incident (2023)](https://hackopedia.blastwave.com/manufacturing/johnson-controls-2023/): FILE 048. Ransomware reached part of a building technology company's internal IT and data was taken; it saw no evidence of impact to its digital products, based on information reviewed to date.

## Energy edition
- [Energy edition overview](https://hackopedia.blastwave.com/energy/): Hackopedia's Energy edition covers twelve incidents from 2014 to 2026. Two caused power outages on the record, both in Ukraine: about 225,000 customers for several hours in December 2015, and about 200 MW in Kyiv in December 2016. Heating stopped in part of Lviv in January 2024. Elsewhere, power and heat stayed on or no physical effect is confirmed.
- [Ukraine Power Grid Cyberattack (2015)](https://hackopedia.blastwave.com/energy/ukraine-power-grid-2015/): FILE 003. Remote intruders opened substation breakers at three distribution companies, cutting power to about 225,000 customers for several hours; crews restored it by hand.
- [Polish Hydropower Plant Incident (2025)](https://hackopedia.blastwave.com/energy/polish-hydropower-plant-2025/): FILE 017. A hacktivist video showed a small hydropower plant's control screen operated until its generator stopped; no one has confirmed which plant, or that anything physical happened.
- [Ukrenergo Kyiv Power Grid Cyberattack (2016)](https://hackopedia.blastwave.com/energy/ukrenergo-2016/): FILE 020. Breakers opened at the Pivnichna substation north of Kyiv, cutting about 200 MW; operators restored power by hand in about an hour and a quarter.
- [Poland Distributed Energy Cyberattack (2025)](https://hackopedia.blastwave.com/energy/poland-distributed-energy-2025/): FILE 028. An attacker disabled field devices at more than thirty wind and solar farms and struck two combined heat and power plants; generation continued and heat was never interrupted.
- [Viasat KA-SAT Cyber Attack and Enercon Wind Turbines (2022)](https://hackopedia.blastwave.com/energy/viasat-ka-sat-enercon-2022/): FILE 030. An attack on Viasat's KA-SAT network wiped modems across Europe; about 5,800 Enercon turbines lost remote monitoring and control but kept generating.
- [Danish Energy Sector Zyxel Firewall Attacks (2023)](https://hackopedia.blastwave.com/energy/danish-energy-sector-2023/): FILE 031. Attackers compromised Zyxel firewalls at 22 energy companies in two waves; operators cut internet links and kept running, with no loss of power or heat on the record.
- [Nova Scotia Power Ransomware Attack (2025)](https://hackopedia.blastwave.com/energy/nova-scotia-power-2025/): FILE 032. Ransomware hit the utility's business network; generation and the grid were not disrupted, but meter readings could not reach the utility, so most bills were estimated.
- [Itron Cyber Incident (2026)](https://hackopedia.blastwave.com/energy/itron-2026/): FILE 033. A metering supplier disclosed unauthorized access to certain systems, later including limited access to certain customer-hosted systems; neither filing mentions meters or the grid.
- [Industroyer2 Attempted Attack on Ukrainian Substations (2022)](https://hackopedia.blastwave.com/energy/industroyer2-2022/): FILE 041. Malware loaded with substation device addresses was scheduled to run; officials said defenders prevented outages, and what stopped it has never been published.
- [FrostyGoop and the Lviv Heating Incident (2024)](https://hackopedia.blastwave.com/energy/frostygoop-2024/): FILE 043. 324 heat points in one district stopped and crews restarted them by hand; Dragos later linked FrostyGoop malware to the attack by assessment.
- [Havex / Dragonfly Cyber Espionage Campaign (2014)](https://hackopedia.blastwave.com/energy/havex-2014/): FILE 047. Installers on three small European industrial software suppliers' websites were swapped for copies carrying a remote access trojan that scanned for OPC servers; no record shows it touched a process.
- [Volt Typhoon Intrusion at Littleton Electric Light and Water (2023)](https://hackopedia.blastwave.com/energy/volt-typhoon-littleton-2023/): FILE 049. Intruders the FBI identified to the utility as Volt Typhoon were in a small public utility's IT network; no primary source places them in its control systems.

## Food, Beverage and Retail edition
- [Food, Beverage and Retail edition overview](https://hackopedia.blastwave.com/food-beverage-retail/): Hackopedia's Food, Beverage and Retail edition covers five incidents from 2013 to 2026, from the Target breach to Mackay Sugar. In four, production or trading stopped: JBS's meat plants, Coop Sweden's stores after the Kaseya attack, Asahi's orders and shipping, and, by growers' account, two Mackay Sugar mills. No entry records an intruder reaching a plant or mill control system.
- [JBS Ransomware Attack (2021)](https://hackopedia.blastwave.com/food-beverage-retail/jbs-2021/): FILE 006. An intrusion on servers supporting North American and Australian IT led JBS to shut systems down, stopping meat plants in three countries; it paid $11 million after most had reopened.
- [Target Data Breach (2013)](https://hackopedia.blastwave.com/food-beverage-retail/target-2013/): FILE 011. Credentials stolen from a refrigeration and HVAC contractor led to malware on store registers and about 40 million card accounts taken; no primary record read puts the HVAC system in the path.
- [Kaseya VSA Supply-Chain Ransomware Attack (2021)](https://hackopedia.blastwave.com/food-beverage-retail/kaseya-vsa-2021/): FILE 012. Vulnerable VSA servers pushed REvil ransomware to the computers they managed; Coop Sweden's tills and scales stopped working and it closed most of its roughly 800 stores.
- [Asahi Ransomware Attack (2025)](https://hackopedia.blastwave.com/food-beverage-retail/asahi-2025/): FILE 035. Ransomware hit Asahi's data center network in Japan and, by its account, containment stopped order placement and shipping; all six breweries were producing again on 2 October.
- [Mackay Sugar Cyber Incident (2026)](https://hackopedia.blastwave.com/food-beverage-retail/mackay-sugar-2026/): FILE 038. By the growers' account, two of three mills and the harvest feeding them stopped; the company never said ransomware, and all three mills were operational by 26 June.

## Transportation and Logistics edition
- [Transportation and Logistics edition overview](https://hackopedia.blastwave.com/transportation-logistics/): Hackopedia's Transportation and Logistics edition covers four incidents from 2017 to 2025: Maersk under NotPetya, the Port of Nagoya, DP World Australia and European airport check-in. In each, a business or terminal system went down, through the attack or the operator's own containment, and physical movement slowed. No entry records an attacker reaching a crane, vessel or aircraft system.
- [Maersk and the NotPetya Cyberattack (2017)](https://hackopedia.blastwave.com/transportation-logistics/notpetya-maersk-2017/): FILE 002. A destructive worm aimed at Ukraine reached Maersk through a backdoored tax software update; container IT went down, terminals were impacted, and Maersk put the effect on profitability at USD 250-300m.
- [DP World Australia Cyber Incident (2023)](https://hackopedia.blastwave.com/transportation-logistics/dp-world-australia-2023/): FILE 009. DP World disconnected from the internet to contain an intrusion; that all but closed the land side gate at four terminals for three days, and no ransomware was found.
- [Port of Nagoya Ransomware Incident (2023)](https://hackopedia.blastwave.com/transportation-logistics/port-of-nagoya-2023/): FILE 045. Ransomware encrypted NUTS, the system shared by all five container terminals; container receiving and release stopped for about 60 hours while ships were worked by hand from paper.
- [Collins Aerospace Ransomware Incident at European Airports (2025)](https://hackopedia.blastwave.com/transportation-logistics/collins-aerospace-2025/): FILE 046. Ransomware on systems supporting shared check-in software sent airlines at Heathrow, Brussels and Berlin to manual check-in; flights were delayed and cancelled but not stopped.

## Contact
- Corrections and new sources: hackopedia@blastwave.com