FBI traces 800 staged SCADA files to a U.S. ICS integrator's own network
Between March and April 2025 intruders searched an industrial automation firm for "customers" and "SCADA", then bundled about 800 files. FBI and CISA now want least privilege applied to integrator access.
The Watch · Security desk
What happened
- FBI technical analysis places malicious foreign cyber actors on the network of a U.S. industrial automation solutions company between March and April 2025, a firm selling system integration, engineering consulting and SCADA programming.
- Its industrial customers included power utilities and transportation entities, and while inside, the actors searched the network for terms including "customers" and "SCADA".
- The agencies want owners to run routine risk assessments against contracts that grant access to industrial systems, measuring the effect on data autonomy and process controls.
Why it matters
- Who's exposed exposure A plant that is never touched can still lose its process design, because the aggregated copy sits with the contractor, and the owner learns about it from someone else's incident response.
- Who has to decide decision Owners renewing integrator agreements now choose between the standing high-privilege account that makes remote support fast and per-task access that slows it down.
- What it limits constraint Adding data-residency, ownership and geopolitical questions to the assessment narrows the set of integrators a U.S. utility can hire without extra justification.
- What it sets up precedent Guidance with no deadline still sets the question auditors and insurers ask after the next OT incident that starts in a vendor account.
Next story · Security · 5d ago
Contractor's missed PeopleSoft patch let attackers into FBI employee dataConfirmed2 publishers
Nine .zip archives, roughly 800 files: customer SCADA information, ICS device details and other schematics [6]. That averages about 89 files per archive [17]. The FBI describes the bundles as created "for presumed exfiltration" [6], so what the agencies document is collection and packaging on the victim's network, not confirmed transfer off it. The fact sheet identifies the intruders only as malicious foreign cyber actors and does not name the company [8].
The access these firms hold is the subject. FBI and CISA list what third-party integrators do inside ICS environments: control system design, installation, operational data analysis, device support and service, and daily operational control [13]. Each of those jobs comes with credentials. The agencies' recommendation is to size them down, and they define least privilege in OT as granting users, processes and systems "only the minimum access necessary to perform their assigned tasks, and no more" [3]. Skip it, the fact sheet says, and owners may hand actors sensitive access to pathways they can exploit to cause disruptive and destructive effects to equipment and critical functions [11].
The recommendation aims at paperwork, not products. Owners should routinely reassess contracts that involve access to industrial systems and judge the effect on their own data autonomy and process controls [9]. The same assessments should cover hardware and software supply chain vulnerabilities introduced by integrator equipment, plus the IT and OT security of those devices and their associated networks [10]. Where design work is contracted out, the obligation runs both ways: integrators and owners have to collectively enforce clear requirements for the secure procurement and handling of system components [15].
Integrators that operate and host data outside the United States get separate treatment, on the grounds that they may be subject to different data storage and management laws that do not meet the security needs of U.S. critical infrastructure entities [14]. Foreign-owned integrators also draw a geopolitical line into the risk assessment [16].
This is a fact sheet of considerations, with no binding requirement and no compliance date [12]. Its use to an asset owner is evidentiary. The next time an integrator asks for high levels of access or control over a physical process [2], there is a dated federal case to cite in which the contractor's network was the route to power utility and transportation customers' schematics [4][6].
What to watch
- Whether FBI or CISA later names the industrial automation company or attributes the March-April 2025 intrusion to a state.
- Whether the staged SCADA information and schematics turn up in a follow-on intrusion at one of that integrator's utility or transit customers.
- Whether least-privilege and data-residency language starts appearing in integrator contract renewals as an audit item.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+12
- Incentives38
- Confidence66
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The FBI and CISA published a fact sheet highlighting considerations for critical infrastructure entities working with third-party industrial control system (ICS) integrators, to reduce risk and minimize vulnerabilities.
- [2]
The fact sheet says critical infrastructure owners and operators should maintain caution when granting third-party ICS integrators high levels of access or control over industrial processes, ensuring the principle of least privilege is applied.
- [3]
The agencies wrote that the principle of least privilege within OT environments "lends itself to granting users, processes, and systems only the minimum access necessary to perform their assigned tasks, and no more."
- [4]
According to FBI technical analysis, between March and April 2025 malicious foreign cyber actors gained access to the network of a U.S. industrial automation solutions company that offered system integration, engineering consulting and SCADA programming for industrial customers, including power utilities and transportation entities.
- [5]
While on the network, the threat actors searched terms including "customers" and "SCADA".
- [6]
The actors created nine .zip files consisting of approximately 800 files for presumed exfiltration, including customer SCADA information, ICS device details, and other schematics.
- [7]
The fact sheet says malicious cyber actors could leverage the exfiltrated information to later conduct disruptive attacks against operational environments and disrupt critical services.
- [8]
The fact sheet identifies the intruders only as "malicious foreign cyber actors" and does not name the industrial automation solutions company.
- [9]
The agencies recommend organizations routinely conduct risk assessments to evaluate contracts that involve access to industrial systems, to determine impacts to the organization's data autonomy and process controls.
- [10]
Risk assessments should address hardware and software supply chain vulnerabilities introduced by integrator equipment, as well as the IT and OT security of these devices and their associated networks.
- [11]
The fact sheet says not adopting principles such as least privilege could expose owners and operators to malicious cyber actors, possibly providing sensitive access to pathways that actors can exploit to cause disruptive and destructive effects to equipment and critical functions.
- [12]
The publication is a fact sheet of considerations and recommendations; it states no binding requirement and no compliance date.
- [13]
Third-party integrators provide services for ICS such as control system design, installation, operational data analysis, device support and service, and daily operational control.
- [14]
The fact sheet says third-party integrators that operate and host data outside the United States may pose additional risks, as they may be subject to different data storage and management laws that do not meet the security needs of U.S. critical infrastructure entities.
- [15]
Owners and operators that rely on third-party integrators for system design face supply chain risks if integrators and owners and operators do not collectively enforce clear requirements for the secure procurement and handling of system components.
- [16]
When considering foreign-owned integrators, the agencies say owners and operators should include geopolitical considerations in their risk assessments.
- [17]
The nine archives held an average of about 89 files each.
Sources
2 independent publishers whose own reporting we read for this story.
- cisa.govConsiderations for Critical Infrastructure Operators Working With Third-Party ICS Integrators
1 article · September 23, 2026
- securityweek.comOT Security Guidance: NIST Drafts Updated Guide, CISA/FBI Advise on ICS Integrators - SecurityWeek
2 articles · September 24, 2026
Topics and entities
Topics
Entities
- NIST Cybersecurity Framework 2.0
- Federal Bureau of Investigation
- National Institute of Standards and Technology
- CISA