SANS: 34% reported ICS/OT incidents in a year

SANS reported that 34% of respondents said they had at least one cybersecurity incident in ICS/OT systems over the previous 12 months, and that 72% of those incidents led to disruption of facilities or systems. The report, published by the SANS Institute, also uses recent attacks on water systems in the United States as reference material, though it does not identify a specific confirmed US victim.

What does the SANS survey show about operational impact?

The survey suggests that a significant share of industrial organizations still report incidents with direct operational effects. According to SANS, these were not limited to detections or failed attempts, but events that in most incident-linked cases affected the continuity of facilities or systems.

The main figure is twofold. On one hand, 34% of respondents said they had suffered an incident in the past year. On the other, 72% of those incidents involved disruption, which places the issue in operational terms rather than only technical visibility.

What recent water cases does the material mention in the United States?

The material cites recent attacks on water services in the United States as context, but SANS does not provide a confirmed US victim. The reference appears in the report as an example of the kind of events driving the resilience debate in ICS/OT environments.

In parallel, secondary coverage attributes to Forescout a technical analysis that identified 22 Rockwell PLCs exposed to the internet in cities affected by those recent attacks. According to that version, 19 of those devices used the same mobile operator network. The analysis counted exposure, not confirmed compromise.

What did secondary coverage say about Minnesota?

Secondary coverage describes different operational impacts in Minnesota, although those effects are not independently confirmed in the available sources. According to The Hacker News, a Braham plant was reportedly taken offline temporarily, while Plymouth reportedly had communications failures at water towers and lift stations, but continued operating manually.

The same coverage adds that South St. Paul and Maple Plain reportedly maintained service despite impacts on automated controls. In all of these cases, the available material refers to exposure, alleged operational effects, or service continuity, but not to a closed technical attribution or a formally verified compromise.