We’re Tracking the Future of Security

Tag: critical infrastructure

  • NIST Quantum Sensors Improve Nuclear Material Monitoring Accuracy

    NIST Quantum Sensors Improve Nuclear Material Monitoring Accuracy

    NIST researchers and international partners have used ultrasensitive quantum sensors to measure X-ray emissions from uranium, plutonium and neptunium with substantially improved precision. The measurements can help analysts separate those X-rays from overlapping gamma-ray signals used to identify and account for nuclear material.

    Transition-edge sensors resolve overlapping signals

    The work used arrays of transition-edge sensors, superconducting devices operated just above absolute zero. An incoming photon produces a measurable change in resistance, allowing the detector to determine its energy with high resolution. NIST reports that the new measurements reduced uncertainty by between one-third and one-eighth compared with earlier values.

    More accurate X-ray data allows monitoring systems to subtract background interference and estimate isotope ratios more precisely. Those ratios are important for nuclear safeguards because they help distinguish material composition and enrichment.

    Deployment still requires specialized infrastructure

    The sensors need cryogenic cooling and are not handheld instruments. NIST says arrays can operate where sufficient power and refrigeration are available, while samples can also be sent to equipped laboratories. The technology may shorten measurement delays at nuclear facilities, but operational adoption requires calibration, chain-of-custody controls and validated procedures. SectechMedia follows related systems in its industrial monitoring coverage.

    Sources

  • Aviation Cybersecurity Survey Reports Average Annual Losses of $1.4 Million

    Aviation Cybersecurity Survey Reports Average Annual Losses of $1.4 Million

    A survey commissioned by cybersecurity company Bridewell reports average breach losses of $1.4 million among U.S. aviation organizations during the previous 12 months. Censuswide surveyed 250 cybersecurity professionals working across the sector.

    Common attacks reached operationally sensitive organizations

    Phishing was the most frequently reported attack in the study. Respondents also described malware, credential theft and distributed denial-of-service incidents. The findings show that aviation cyber risk extends across business systems, airport operations, service providers and supply-chain connections.

    Financial impact varied, but a large share of respondents placed losses between hundreds of thousands and several million dollars. Concern was particularly high around operational infrastructure and third parties, where one compromised connection can affect several organizations.

    Spending must translate into tested resilience

    More respondents reported increasing cybersecurity budgets, while specialist recruitment remained difficult. Aviation operators should therefore measure whether investment improves asset visibility, identity controls, segmentation, recovery time and supplier assurance rather than treating spending alone as a maturity indicator.

    The results are relevant to SectechMedia’s Industrial Safety & Monitoring coverage. Airports and aviation service providers should exercise degraded operations, verify backup communications and require suppliers to report incidents promptly. A defensible program links cyber monitoring with physical operations so that a digital outage does not create an unmanaged safety or access-control condition.

    Sources

  • Michigan Plastics Plant Fire Disrupts Power Near South Haven

    Michigan Plastics Plant Fire Disrupts Power Near South Haven

    A major fire at East Jordan Plastics near South Haven, Michigan, spread from plastic pallets stored outside the facility into the factory and disrupted electrical service in parts of the community. Local reporting said smoke was visible for miles as multiple fire agencies responded.

    Propane explosions complicated the response

    South Haven Area Emergency Services said early propane explosions threw tanks into the air while crews worked the third-alarm incident. At least six agencies participated in the response. Employees evacuated safely, and no injuries had been reported in the initial public information.

    The fire’s proximity to critical electrical infrastructure added a second operational problem. The City of South Haven said an electric transmission feed was cut because the incident threatened a municipal utility substation. Power restoration depended on progress toward containment, and the public was asked to stay away from the area.

    Industrial incidents can cross system boundaries

    The event illustrates why industrial emergency planning must account for stored materials, pressurized containers, utility dependencies and access for mutual-aid crews. Detection and suppression systems are important, but pre-incident surveys, isolation plans and coordination with energy providers can determine how far consequences spread beyond a facility. SectechMedia follows related engineering risks in its fire and safety coverage.

    Sources

  • Idaho National Laboratory Introduces TOPGEAR for Cyber-Physical Influence Risk

    Idaho National Laboratory Introduces TOPGEAR for Cyber-Physical Influence Risk

    Idaho National Laboratory is developing TOPGEAR, a platform intended to show how corporate relationships and individual influence can create risk around critical infrastructure. The name stands for Technology, Organization and Person of Interest Graph Extraction, Analysis and Reporting.

    Looking beyond a conventional cyberattack

    Traditional assessments often concentrate on software vulnerabilities, network boundaries and physical hazards. TOPGEAR instead connects information about organizations, people and infrastructure assets. The objective is to reveal how investments, acquisitions, board positions or supplier relationships could create influence over facilities such as substations and data centers without a malware incident.

    Industrial Cyber reports that the platform draws on public sources including regulatory filings and energy data, then represents the information across social, infrastructure and cross-layer networks. Analysts can examine how an entity is connected to an asset and identify concentrations that may deserve additional review. The output is an aid to analysis, not proof that a relationship is malicious.

    A broader resilience model

    The project illustrates why critical-infrastructure protection requires ownership, supplier and governance data as well as technical telemetry. Organizations adopting similar methods should record source provenance, confidence and update dates so that old or ambiguous relationships do not become false accusations. TOPGEAR adds another perspective to security intelligence by treating organizational influence as a cyber-physical dependency.

    Sources

  • CISA Publishes Cyber Decoy Guidance for Critical Infrastructure Defenders

    CISA Publishes Cyber Decoy Guidance for Critical Infrastructure Defenders

    The U.S. Cybersecurity and Infrastructure Security Agency has released its first detailed guide to designing and operating cyber decoys for critical infrastructure environments. The approach places realistic but controlled systems and information assets inside a network so that attempts to access them can generate high-confidence evidence of malicious activity.

    CISA said decoys can help expose attackers who use stolen credentials, legitimate administration tools and living-off-the-land techniques that may bypass conventional perimeter controls. The guide aligns implementation with the MITRE ATT&CK knowledge base and MITRE Engage framework, and treats decoys as a complement to zero-trust controls rather than a replacement for asset management, identity security or monitoring.

    The agency recommends planning decoys around likely adversary paths and high-value areas, then integrating the resulting alerts into established investigation and response procedures. Organizations must also prevent a decoy from becoming a pivot point and ensure its data does not create privacy or operational risk.

    Why it matters

    Critical infrastructure defenders often face weak signals from legitimate-looking activity. Properly isolated decoys can give operations teams an earlier, higher-confidence warning that an intruder is moving through the environment. That makes them relevant to the broader task of risk-based security planning.

    Sources

  • Foreign Hackers Breach Two Colorado Water Utilities, Alter Pump Cycles and Disable Alarms

    Foreign Hackers Breach Two Colorado Water Utilities, Alter Pump Cycles and Disable Alarms

    Foreign hackers breached the computer systems of two small Colorado water utilities last month, changing pumping cycles, disabling alarms and altering equipment settings before operators regained control, state officials disclosed on September 19, 2026.

    What Happened

    According to Colorado officials, the intrusions did not compromise drinking water quality or treatment processes, and the affected utilities’ operators were able to identify and reverse the unauthorized changes. Governor Jared Polis’s office described the incidents as “brief” and said the associated risks were “quickly addressed by the providers themselves.” The identities of the specific utilities have not been publicly disclosed.

    Officials have not attributed the intrusions to a specific threat actor, though the state noted that previous, similarly styled attacks on US water infrastructure this year have been linked to actors with suspected ties to Iran and China.

    Part of a Wider Pattern

    The Colorado incidents add to a year in which more than 100 drinking water and wastewater systems across at least a dozen US states — including Minnesota, Michigan, Georgia, South Dakota and New Jersey — have reported cyberattacks targeting internet-exposed programmable logic controllers (PLCs). In late July, hackers broke into the operational technology behind more than 30 municipal water systems in Minnesota, changing passwords and IP addresses on exposed PLCs and locking operators out of their own equipment.

    The pattern echoes an earlier wave documented in coordinated attacks that disabled a UK power plant and hit US water utilities, and follows a related warning about active reconnaissance against internet-exposed Siemens S7 PLCs flagged by CISA, the NSA and the FBI.

    Federal Response

    The US Environmental Protection Agency (EPA) said it is investigating the Colorado breaches and working with the affected utilities to identify vulnerabilities and strengthen defenses. The agency has previously reported identifying more than 900 vulnerabilities across over 650 water systems nationwide in 2026, and says it has helped remediate roughly 700 of those weaknesses across more than 500 utilities.

    Why It Matters

    Water and wastewater utilities are frequently smaller, resource-constrained operators with internet-exposed industrial control systems and limited dedicated cybersecurity staff, making them attractive, comparatively low-effort targets for state-linked and opportunistic threat actors alike. Security researchers and federal advisories have repeatedly urged utilities to take PLCs off the public internet, enforce multifactor authentication for remote access, and monitor for unauthorized changes to ladder logic and equipment configurations.

  • CenterPoint Energy Confirms Customer Data Breach; Utility Services Unaffected

    CenterPoint Energy Confirms Customer Data Breach; Utility Services Unaffected

    Houston-based utility CenterPoint Energy has told regulators that an unauthorized third party obtained personal information relating to some customers through an external-facing system. The company opened an investigation after becoming aware of a claim that customer data had been obtained.

    In its filing with the U.S. Securities and Exchange Commission, CenterPoint said the incident had not affected delivery of electric or natural-gas services and that it did not expect a material effect on the company. The filing did not validate a hacker’s separate claim about the number of records involved.

    SecurityWeek reported that a threat actor had advertised an archive allegedly containing CenterPoint data. That claim remains unverified, so the confirmed facts are narrower: customer information was accessed, an investigation is underway, and operational utility delivery continued.

    Why it matters

    The separation between customer-facing systems and operational service delivery is important for critical infrastructure. A breach can create serious privacy and fraud exposure even when operational technology remains available, and incident reporting should keep those impacts distinct.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • Cyberattack on Manchester Airports Group Exposes Data of 8.7 Million Customers

    Cyberattack on Manchester Airports Group Exposes Data of 8.7 Million Customers

    Manchester Airports Group, which operates Manchester, London Stansted and East Midlands airports in England, said on August 27, 2026 that it was hit by a cyberattack exposing data belonging to roughly 8.7 million customers, according to the company’s public notice and reporting by The Record and the Yorkshire Post. An unauthorized third party accessed customer data tied to car park, lounge and Fast Track bookings, as well as in-airport Wi-Fi sign-ups.

    The compromised information includes email addresses, phone numbers, vehicle registrations and postcodes; the company said neither it nor the affected system stores payment card or banking details, and that no financial data was exposed. MAG said it was alerted to the incident on a Tuesday and believes attackers first accessed the data a few days before discovery. The company has restricted access to the affected systems, engaged outside cybersecurity specialists, notified relevant authorities and temporarily suspended its online Manage My Booking service as a precaution.

    MAG said passenger safety and aviation security systems were not affected and that flights, airport operations and parking continue to operate normally; the three airports handled more than 65 million passengers last year. The incident illustrates a distinction increasingly emphasized by airport operators: a breach of customer-facing IT and booking systems does not necessarily indicate any compromise of the physical security, screening or airside operational systems that are typically segmented onto separate networks.

  • White House Bans Foreign-Made Bulk-Power System Equipment Over Cyber Backdoor Concerns

    White House Bans Foreign-Made Bulk-Power System Equipment Over Cyber Backdoor Concerns

    President Trump signed an executive order on August 26, 2026 declaring a national emergency over the security of the U.S. bulk-power system and banning the acquisition or installation of foreign-made equipment used to manage electricity transmission and generation, according to the order published by the White House and reporting by The Record. The order covers technology tied to transmission lines rated at 69,000 volts or higher, along with substations, control rooms, power generating stations and reactors, as well as associated software and firmware that could be remotely accessed or updated by foreign governments.

    The administration said the action responds to a pattern of foreign actors “creating and exploiting vulnerabilities” in bulk-power system technology that could enable remote access or supply-chain disruptions. The order directs the Departments of Defense, Commerce and Energy to review transactions involving bulk-power equipment and calls for a published list of pre-qualified vendors and components that federal agencies and utilities can rely on going forward.

    The order follows a string of confirmed intrusions into critical infrastructure operators this year, including cyberattacks affecting water utilities in multiple U.S. states and a reported multi-day shutdown of a small power plant in the United Kingdom, incidents that researchers have variously linked to Iranian, Russian and Chinese-linked hacking groups. For operators of power generation and transmission facilities, the order effectively elevates supply-chain vetting of grid control and monitoring equipment to the same priority long applied to physical perimeter security and access control systems protecting the same sites.

  • Integrated DAS and DTS: Combining Acoustic and Thermal Intelligence

    Integrated DAS and DTS: Combining Acoustic and Thermal Intelligence

    DAS and DTS observe different physical phenomena, but together they can provide a richer view of critical infrastructure. Acoustic events may indicate movement or mechanical activity while temperature changes reveal thermal stress, fire or abnormal operating conditions.

    Complementary sensing

    DAS detects vibration and acoustic signatures; DTS measures distributed temperature. Combining both allows the same corridor to be monitored for security events and asset-condition changes.

    Power and cable networks

    DTS can identify thermal loading while DAS detects nearby digging, disturbance or unusual vibration. The combination supports both reliability and physical protection.

    Pipeline corridors

    DAS can classify activity and acoustic events while DTS contributes thermal context where product temperature or leak-related effects are relevant.

    Unified analytics

    The challenge is turning two large data streams into usable alarms. Edge processing, event correlation and GIS visualization can help operators focus on meaningful anomalies.

    Procurement implications

    Buyers should evaluate integration at the data and workflow level, not simply whether two interrogators can be installed in the same cabinet. Shared timing, location mapping, APIs and alarm management are central to real operational value.

    Conclusion

    Integrated DAS and DTS for Critical Infrastructure Monitoring should be evaluated as part of a broader operational architecture. The strongest deployments combine suitable sensing technology, resilient communications, clear procedures and measurable performance rather than relying on a single device or headline specification.