Why Energy Companies Should Strengthen OT Incident Response

Cyberattacks on critical infrastructure demonstrate how stronger OT incident response can help organizations maintain operational resilience.

Cyberattacks against energy and other critical infrastructure disrupt more than data and business systems. Threat actors who gain access to operational technology (OT) can interfere with the physical processes that organizations depend on to deliver essential services.

Strong OT incident response requires organizations to understand their exposure, prepare teams to make operational decisions during an incident, and build the capacity to recover trusted control. Recent attacks demonstrate the risks and offer lessons for strengthening operational resilience.

Polish attacks expose risks to OT

In December 2025, coordinated cyberattacks struck at least 30 wind and solar farms, a large heat and power plant, and a manufacturing company in Poland. The objective was not extortion. According to Computer Emergency Response Team (CERT) Polska, it was destruction. The threat actors damaged remote terminal units, erased files, reset communications equipment, and deployed wiper malware. Several renewable sites lost communications and remote control, although generation continued and the power system remained stable. At the heat and power plant, an attempted wiper deployment was blocked by endpoint security.

The coordinated attacks in Poland illustrate what OT incident response teams aim to protect: continued control of a physical process. CERT Polska linked the infrastructure used in the attacks to the Russian-associated cluster known as Static Tundra, Berserk Bear, Ghost Blizzard, or Dragonfly – stopping short of attributing the operation to Sandworm.

No matter who was ultimately responsible for the attacks, the takeaway for energy companies is that determined threat actors do not need to breach corporate networks to move laterally into operations. Internet-exposed remote access, cellular communications, maintenance virtual private networks (VPNs), serial gateways, reused credentials, default device accounts, and older field equipment provide a more direct path to the process itself. Organizations can and should take proactive steps to mitigate risk by shoring up OT security.

The forgotten edge might be the front door

Too often, OT security planning assumes that attackers will enter through enterprise IT and work toward the control network. Distributed operations offer other paths, such as cellular modems, vendor VPNs, radio links, serial-to-internet protocol converters, engineering laptops, temporary maintenance connections, and routers deployed with packaged equipment. Some are installed by integrators or local teams and never enter the central asset inventory. The security team might have strong visibility at the IT and OT boundary while lacking a definitive view of how field sites can be reached from outside. A connection can outlive its original purpose with weak credentials, obsolete firmware, little logging, and no accountable owner.

Joint guidance from the UK National Cyber Security Centre, the Cybersecurity and Infrastructure Security Agency, the Federal Bureau of Investigation, and allied agencies pointed explicitly to the fact that OT network edges are difficult to identify. For example, an unsecured radio link might be missing from network diagrams but still form part of the attack surface. The guidance calls for organizations to document every connection, eliminate direct inbound exposure, broker remote access through secured gateways, and continually search for public-facing assets.

When suspicious activity appears at a remote site, investigators cannot limit scoping to enterprise logs and the formal IT or OT conduit. Investigators must identify each way the site communicates, including but not limited to cellular links, vendor tunnels, radios, cloud platforms, gateways, and temporary connections. Otherwise, they might clean the visible network while leaving the attackers’ original path intact.

Small footholds create operational problems

In 2023, Islamic Revolutionary Guard Corps (IRGC)-affiliated actors operating as “CyberAv3ngers” compromised internet-connected Unitronics programmable logic controllers used by U.S. water and wastewater facilities and other critical infrastructure organizations. U.S. authorities said the actors exploited devices exposed to the internet, including systems still using a default password. An affected water authority took a compromised controller offline, moved operations to manual control, and avoided water service disruption. The U.S. Department of the Treasury later sanctioned six officials in Iran’s IRGC Cyber-Electronic Command responsible for the attack.

While the impact in this specific incident was limited, the mode of attack is important. Adversaries do not always need zero-day exploits or an enterprise foothold. They can find an exposed device, use a weak or default credential, and reach a physical function.

In July 2026, the FBI and EPA warned of a separate, unattributed wave of attacks against internet-facing water controllers in at least seven states. Effects included loss of monitoring and control, pressure loss, and flooding. The common thread is field equipment reachable from the public internet without strong access controls.

Building incident response around operational decisions is critical

Security operations teams cannot manage OT incident response alone. Effective response requires coordination among an incident commander, operations, OT engineering, IT security, safety, legal, communications, and relevant vendors or integrators.

The response plan should establish who can isolate a remote site, when operators can safely move to manual operation, who validates controller logic, and who contacts vendors, preserves evidence, and handles reporting. Defining those responsibilities in advance can help teams make operational decisions without unnecessary delay during an incident.

Field sites might be located hours away from qualified personnel, so plans must account for travel time, loss of primary communications, and offline access to diagrams, contacts, configurations, and recovery procedures. Playbooks should also identify who owns each edge connection, who can disable it, what capability the organization will lose, and what alternate path is available.

Containment options should be precise and reversible wherever possible. Instead of defaulting to a broad shutdown, responders might block a specific connection, disable remote access, isolate an engineering workstation, separate enterprise and control networks, place equipment in a known safe state, or move part of the process to local control. Responders should evaluate each option based on its effect on safety, visibility, and service continuity.

Recovering control is more than file restoration

The Polish incident shows why OT recovery requires more than conventional backups. Attackers targeted firmware, controller files, human-machine interfaces, communications devices, and the infrastructure needed for remote supervision.

Effective recovery depends on known-good firmware and logic, validated device configurations, spare or replaceable hardware, current asset records, and personnel who can safely rebuild and recommission equipment. Organizations also need to decide when operational recovery takes priority over forensic preservation.

Safety and service continuity might demand immediate action while understanding the intrusion might require controller logic, volatile data, network captures, and system images. The response plan should establish who makes that decision and how evidence can be collected without destabilizing operations.

Finally, teams should exercise the decisions rather than simply review the document. Tabletop scenarios should test compromised vendor access, unauthorized logic changes, loss of remote visibility, destructive malware, and an IT incident with possible OT exposure. Participants should practice isolation approvals, manual operations, vendor escalation, offline communications, evidence preservation, and recovery validation.

Resilience is the real measure of readiness

The Polish attacks demonstrate the importance of maintaining operations during a cyber incident. Despite destructive actions against industrial devices, power generation and heat delivery continued. Similarly, operators at the compromised U.S. water authority isolated the affected controller, switched to manual operations, and maintained public water service.

Effective OT incident response prioritizes the organization’s ability to maintain safe control and limit operational disruption. The speed of malware removal provides only one measure of success. Organizations must also restore trusted systems and apply lessons from the incident to strengthen future response. For energy companies, effective incident response is a core capability for operational resilience.