The storm

One weekend in late July, in more than thirty towns, the controllers that run the water plants stop answering to the people who run them. Passwords are changed. Addresses are changed. Control logic is rewritten, the safety shutdowns are switched off, and the screens the operators can still see are made to lie. In one town the tower cannot fill for over an hour. Two others go to manual. A fourth declares an emergency. Within a week it is at least twelve states. The tools were the vendors' own engineering software, run from rented servers, against controllers anyone could find on the internet. The water stayed safe to drink. Nothing about the controllers made that so.

In the dead of winter, the heating controllers for six hundred apartment buildings begin receiving temperature readings that are not true. They do what controllers do with readings: they act on them. About a hundred thousand people lose heat and hot water for two days in sub-zero weather. Nothing was broken. The controllers were lied to, over a protocol with no way to tell a lie from the truth. The way in was a router nobody had patched.

Eleven days into a war, a company watches eighty thousand of its computers wipe themselves in about three hours. No malware. One stolen administrator credential and the company's own device-management console, doing exactly what it was built to do. The devices in hospitals survived because they were on a different network.

A utility serving two towns, with the staff of a small town, hosts a state-sponsored group for more than three hundred days. The visitors break nothing. They copy the operating procedures and the layout of the grid: what you need to know exactly where to strike, later, at a time of your choosing.

Two days before the new year, a wiper reaches two combined heat-and-power plants and the management system for a fleet of wind and solar generation. It is stopped before the lights go out. The country calls it the largest cyberattack it has seen in years; the US agency that watches these things says it should put every infrastructure operator on notice.

Someone on the internet types a weak password into a dam's web control panel and opens a valve. Five hundred litres a second flow for nearly four hours before anyone notices.

One of the largest retail breaches on record began with a heating and refrigeration contractor's login. The contractor had remote access to watch store temperatures and energy use. From there to forty million card numbers was a matter of network segmentation nobody had done.

Ransomware takes a hospital's building systems: the central monitoring of heating and cooling, the staff door cards, the elevators. Patients keep receiving care, because the equipment itself keeps running without its supervisor. That is what good looks like. The machines kept working when the computer above them was lost.