crackthe.netDeutsch
Menu

The biggest attacks

The cyberattacks with the largest confirmed impact, from crypto thefts to national outages, and the attacks on industrial control systems.

IT attacks
22
Loss of USD 500 million or more
6
Data of 100 million or more
10
National outages
8
Attacks on industrial control systems
10

The biggest IT attacks

  1. Binance hack in block letters on a terminal, with the year and the main figure

    Crypto theft Loss met

    Binance hack

    stolen, according to Binance
    USD 6.3 billion
    blockchains on which its hot wallets were drained (Elliptic)
    11

    The figures are still changing.

    Binance says the intruders got in partly through a compromised staff laptop and drained its hot wallets within about four hours. Binance is covering the loss from company funds, and the FBI blames North Korea.

    Victim
    Binance, the largest cryptocurrency exchange
    Attributed to
    North Korea (TraderTraitor), according to the FBI
    What helps against attacks like this
    • Keep on an exchange only what you trade. Keep savings in a wallet whose keys you hold, such as a hardware wallet. Hardware wallets
    • Turn on a withdrawal allow-list and sign in with a security key or an authenticator app.
  2. Bybit hack in block letters on a terminal, with the year and the main figure

    Crypto theft Loss met

    Bybit hack

    in virtual assets stolen (FBI)
    USD 1.5 billion
    ether and staked-ether tokens taken (Bybit)
    ~401,000

    During a routine transfer from Bybit's ether cold wallet, the signers saw a manipulated interface. They approved a transaction that handed the wallet to the attackers. It was the largest crypto theft on record until the Binance hack.

    Victim
    Bybit, a cryptocurrency exchange in Dubai
    Attributed to
    North Korea (TraderTraitor), according to the FBI
    What helps against attacks like this
    • Keep long-term holdings in a wallet you control, and use a withdrawal allow-list on exchanges. Hardware wallets
    • Organizations: check every transaction on a separate, trusted device before signing it.
  3. Snowflake customer breaches in block letters on a terminal, with the year and the main figure

    Data theft and extortion Data met

    Snowflake customer breaches

    customer organizations broken into (US Department of Justice)
    165+
    people affected at those customers (US Department of Justice)
    100 million+

    Criminals logged into customers' Snowflake accounts with passwords stolen by infostealer malware. The accounts had no multi-factor sign-in, and the criminals copied the data and demanded ransom.

    Victim
    Customers of the Snowflake cloud data platform, including AT&T, Ticketmaster, and Santander
    Attributed to
    Criminal hackers charged by the US Department of Justice; one pleaded guilty in August 2026
    What helps against attacks like this
    • Keep malware protection up to date: infostealers take the passwords saved on a device.
    • Be wary of messages that mention your call or purchase history.
    • Organizations: require multi-factor sign-in on every cloud account and replace old passwords.
  4. Change Healthcare ransomware attack in block letters on a terminal, with the year and the main figure

    Ransomware Loss met Data met Outage met

    Change Healthcare ransomware attack

    people whose data was stolen (Change Healthcare)
    192.7 million
    costs in 2024 for the response and the disruption (UnitedHealth)
    USD 3.1 billion

    Ransomware shut down Change Healthcare in February 2024. Pharmacies and clinics across the US could not bill or check insurance for weeks. The data of about 193 million people was stolen.

    Victim
    Change Healthcare (UnitedHealth Group), which processes a large share of US medical claims and pharmacy payments
    Attributed to
    ALPHV/BlackCat ransomware, according to UnitedHealth
    What helps against attacks like this
    • Organizations: require multi-factor sign-in on every remote-access portal.
    • Keep offline backups and test restoring core systems.
    • Clinics and pharmacies: keep a second way to file claims and take payments.
  5. Kyivstar cyberattack in block letters on a terminal, with the year and the main figure

    Sabotage Outage met

    Kyivstar cyberattack

    mobile subscribers without service (Kyivstar)
    24 million
    until all services were back (VEON)
    1 week

    A destructive attack on December 12, 2023, took Ukraine's largest mobile network offline. About 24 million subscribers lost phone and internet service, and some air-raid alerts and card terminals failed too.

    Victim
    Kyivstar, Ukraine's largest mobile operator
    Attributed to
    Russian military intelligence (GRU unit 74455, Sandworm), according to Ukraine's SBU
    What helps against attacks like this
    • Keep a second SIM or eSIM from another operator for emergencies.
    • Organizations: keep administrator accounts under strict control.
    • Keep offline backups and a rehearsed plan to rebuild systems.
  6. DP World Australia cyberattack in block letters on a terminal, with the year and the main figure

    Network intrusion Outage met

    DP World Australia cyberattack

    without trucks collecting or delivering containers at four ports (DP World)
    3 days
    containers backed up (DP World)
    30,000+

    Intruders in DP World Australia's network forced the company to cut its four container terminals off the internet in November 2023. The government called it a nationally significant incident.

    Victim
    DP World Australia, which runs container terminals in Sydney, Melbourne, Brisbane, and Fremantle
    Attributed to
    Not attributed
    What helps against attacks like this
    • Organizations: keep manual procedures ready for when systems fail.
    • Separate networks, so that one intrusion cannot reach everything.
    • Keep offline backups.
  7. Costa Rica government ransomware attacks in block letters on a terminal, with the year and the main figure

    Ransomware Outage met

    Costa Rica government ransomware attacks

    ransomware groups: Conti against the government, Hive against the social security fund
    2
    of 1,500 servers of the social security fund encrypted (CCSS)
    ~30

    Conti ransomware hit Costa Rica's finance ministry and other agencies in April 2022, and the new government declared a national emergency. A second attack on May 31 sent the hospitals and clinics of the social security fund back to paper for weeks.

    Victim
    Costa Rica's government, starting with the finance ministry, and the social security fund CCSS
    Attributed to
    Conti and Hive ransomware, according to the government and the CCSS
    What helps against attacks like this
    • Organizations: require multi-factor sign-in for all remote access.
    • Keep offline backups and test restoring them.
    • Clinics: keep paper procedures ready for downtime.
  8. Ronin bridge hack in block letters on a terminal, with the year and the main figure

    Crypto theft Loss met

    Ronin bridge hack

    stolen (FBI)
    USD 620 million
    until anyone noticed (Ronin)
    6 days

    Attackers took control of five of the nine validator keys that secure the Ronin bridge and withdrew 173,600 ether and 25.5 million USDC. Nobody noticed for six days, until a user could not withdraw.

    Victim
    Ronin Network, the bridge of the game Axie Infinity (Sky Mavis)
    Attributed to
    North Korea's Lazarus Group and APT38, according to the FBI
    What helps against attacks like this
    • Treat unexpected job offers and files from recruiters as a possible attack.
    • Organizations: spread signing keys across independent parties and alert immediately on large withdrawals.
  9. Iran fuel station cyberattack in block letters on a terminal, with the year and the main figure

    Sabotage Outage met

    Iran fuel station cyberattack

    sales of subsidized fuel by smart card disrupted (Iranian officials)
    nationwide

    A cyberattack on October 26, 2021, shut down the smart-card system Iranians use to buy subsidized fuel. Long lines formed at gas stations across the country. Officials confirmed the attack, and many stations were still closed the next day.

    Victim
    Iran's smart-card system for subsidized fuel and the gas stations that use it
    Attributed to
    Iranian officials blamed an unnamed foreign country
    What helps against attacks like this
    • Organizations: keep a way to sell and take payment when the central system is down.
    • Keep central management systems under strict control.
    • Keep offline backups and rehearse recovery.
  10. Transnet port terminals cyberattack in block letters on a terminal, with the year and the main figure

    Ransomware Outage met

    Transnet port terminals cyberattack

    container terminals under force majeure: Durban, Ngqura, Gqeberha, Cape Town (Transnet)
    4
    until force majeure was lifted on August 2 (Transnet)
    11 days

    A cyberattack in July 2021 disabled the system that runs South Africa's main container terminals, and staff fell back on manual work. Transnet declared force majeure until the system was restored.

    Victim
    Transnet, South Africa's state port and rail operator
    Attributed to
    Not attributed
    What helps against attacks like this
    • Organizations: keep manual procedures ready for when systems fail.
    • Keep offline backups and test restoring them.
    • Separate networks, so that one intrusion cannot reach everything.
  11. HSE ransomware attack (Ireland) in block letters on a terminal, with the year and the main figure

    Ransomware Outage met

    HSE ransomware attack (Ireland)

    until all servers were decrypted (Comptroller and Auditor General)
    130 days
    IT devices at about 4,000 locations (Comptroller and Auditor General)
    70,000+

    Conti ransomware hit Ireland's national health service on May 14, 2021, and the HSE switched off its entire IT network. Hospitals worked on paper, and radiotherapy and other services stopped.

    Victim
    Health Service Executive (HSE), Ireland's public health service
    Attributed to
    Conti ransomware, named by the HSE
    What helps against attacks like this
    • Organizations: watch for attacks around the clock and act on alerts.
    • Keep offline backups and tested restore plans.
    • Separate the networks of connected organizations.
  12. Colonial Pipeline ransomware attack in block letters on a terminal, with the year and the main figure

    Ransomware Outage met

    Colonial Pipeline ransomware attack

    that the main fuel pipeline to the US East Coast was shut (Colonial Pipeline)
    5 days
    ransom paid; the FBI seized 63.7 BTC back (US Department of Justice)
    75 BTC

    Ransomware in Colonial Pipeline's office IT led the company to shut down the main fuel pipeline to the US East Coast in May 2021. Panic buying left many gas stations dry.

    Victim
    Colonial Pipeline, the largest fuel pipeline in the US
    Attributed to
    DarkSide ransomware, according to the FBI
    What helps against attacks like this
    • Organizations: separate office IT from the systems that run operations.
    • Require multi-factor sign-in on every remote-access account.
    • Keep offline backups and a rehearsed plan for manual operation.
  13. Facebook phone number scrape in block letters on a terminal, with the year and the main figure

    Scraping Data met

    Facebook phone number scrape

    Facebook users in 106 countries (German Federal Court of Justice)
    533 million
    fine from the Irish Data Protection Commission
    EUR 265 million

    Before September 2019, attackers abused Facebook's contact import to match phone numbers to profiles. The data set was published free online in April 2021.

    Victim
    Meta (Facebook) and its users
    Attributed to
    Not attributed
    What helps against attacks like this
    • Hide your phone number and email address from profile search.
    • Treat unexpected calls and texts that use your name as possible phishing.
    • Use two-factor sign-in with an app, not by text message.
  14. Capital One data breach in block letters on a terminal, with the year and the main figure

    Data theft Data met

    Capital One data breach

    people in the US and Canada (Capital One)
    106 million
    penalty from the US bank regulator OCC
    USD 80 million

    Through a misconfigured cloud setup, an intruder downloaded data on about 100 million people in the US and 6 million in Canada. Most came from credit card applications. The US bank regulator fined Capital One 80 million dollars for weak risk controls in its move to the cloud.

    Victim
    Capital One, a US bank
    Attributed to
    A former tech worker in Seattle, acting alone; convicted by a US jury in 2022
    What helps against attacks like this
    • Freeze your credit if your Social Security or Social Insurance Number was exposed.
    • Organizations: review cloud storage permissions and access roles regularly.
  15. Marriott (Starwood) guest database breach in block letters on a terminal, with the year and the main figure

    Data theft Data met

    Marriott (Starwood) guest database breach

    guest records at most (Marriott)
    383 million
    unencrypted passport numbers (Marriott)
    5.25 million

    Attackers were inside the reservation database of the Starwood hotel group from 2014 until 2018. Marriott bought Starwood in 2016 and found the intrusion only in 2018.

    Victim
    Marriott International, through the guest database of the Starwood hotels
    Attributed to
    Not attributed
    What helps against attacks like this
    • Use a different password for every loyalty program. Password managers
    • Be wary of emails that mention your bookings or loyalty number.
    • Organizations: check the IT of companies you take over for intrusions.
  16. MyFitnessPal data breach in block letters on a terminal, with the year and the main figure

    Data theft Data met

    MyFitnessPal data breach

    user accounts (Under Armour)
    150 million

    An unauthorized party took usernames, email addresses, and hashed passwords of MyFitnessPal users. Payment card data was stored separately and was not affected.

    Victim
    Under Armour, maker of the MyFitnessPal app
    Attributed to
    Not attributed
    What helps against attacks like this
    • Use a password manager and a different password for every service. Password managers
    • Turn on two-factor sign-in where the app offers it.
  17. Coincheck NEM theft in block letters on a terminal, with the year and the main figure

    Crypto theft Loss met

    Coincheck NEM theft

    in customers' NEM coins stolen (Japan's Financial Services Agency), about USD 530 million at the time
    JPY 58 billion
    NEM coins moved out (Coincheck)
    523 million

    Attackers obtained the private keys of the online wallet that held all of Coincheck's customer NEM coins. They moved the coins out within about eight hours. Japan's regulator ordered the exchange to improve its controls.

    Victim
    Coincheck, a cryptocurrency exchange in Tokyo, and its customers
    Attributed to
    Not attributed
    What helps against attacks like this
    • Keep larger crypto amounts in a hardware wallet you control, not on an exchange. Hardware wallets
    • Exchanges: keep most customer coins in offline (cold) storage.
  18. Equifax data breach in block letters on a terminal, with the year and the main figure

    Data theft Data met

    Equifax data breach

    people whose names and birth dates were taken (FTC)
    147 million
    settlement at most, with the FTC, the CFPB, and US states
    USD 700 million

    Attackers got in through an unpatched web application and took names, birth dates, and Social Security numbers of about 147 million people. Equifax agreed to pay up to 700 million dollars.

    Victim
    Equifax, a US credit reporting agency
    Attributed to
    Four members of China's People's Liberation Army, charged by the US Department of Justice in 2020
    What helps against attacks like this
    • In the US: freeze your credit with the credit bureaus.
    • Check your credit reports for accounts you did not open.
    • Organizations: quickly patch systems that face the internet.
  19. Yahoo data theft of 2013 in block letters on a terminal, with the year and the main figure

    Data theft Data met

    Yahoo data theft of 2013

    user accounts: every account that existed in August 2013 (Yahoo)
    3 billion

    Attackers copied data of every Yahoo user account that existed in August 2013. Yahoo disclosed the theft in December 2016 and said only in October 2017 that all accounts were affected.

    Victim
    Yahoo
    Attributed to
    Not attributed
    What helps against attacks like this
    • Use a password manager and a different password for every service. Password managers
    • Turn on two-factor sign-in, above all for your main email account.
    • Choose security answers that nobody can look up.
  20. Yahoo data theft of 2014 in block letters on a terminal, with the year and the main figure

    Data theft Data met

    Yahoo data theft of 2014

    user accounts at least (Yahoo)
    500 million
    SEC penalty for telling investors two years late
    USD 35 million

    Account data of at least 500 million Yahoo users was stolen in late 2014, including names, email addresses, birth dates, and hashed passwords. Yahoo told the public only in September 2016.

    Victim
    Yahoo
    Attributed to
    Two officers of Russia's FSB intelligence service and two hackers working with them, charged by the US Department of Justice in 2017
    What helps against attacks like this
    • Use a password manager and a different password for every service. Password managers
    • Turn on two-factor sign-in for email accounts.
  21. Carbanak and Cobalt bank thefts in block letters on a terminal, with the year and the main figure

    Bank theft Loss met

    Carbanak and Cobalt bank thefts

    losses of the financial industry in total (Europol)
    EUR 1 billion+
    banks and other financial institutions in 40 countries (Europol)
    100+

    A criminal group sent spear-phishing emails to bank staff and took over internal systems. It stole money through fraudulent transfers and through ATMs that paid out on command.

    Victim
    More than 100 banks and other financial institutions in about 40 countries
    Happened
    2013 to 2018
    Attributed to
    A criminal group; Europol said its suspected leader was arrested in Spain in March 2018
    What helps against attacks like this
    • Banks: give staff phishing-resistant sign-in and keep administrator rights tight.
    • Keep payment and ATM systems apart from office networks, and alert on unusual transfers.
  22. Heartland Payment Systems breach in block letters on a terminal, with the year and the main figure

    Data theft Data met

    Heartland Payment Systems breach

    card numbers stolen from Heartland and four other companies (US Department of Justice)
    130 million+
    costs Heartland booked for 2009 (annual report)
    USD 128.9 million

    Attackers broke in through a SQL injection flaw and planted malware that read card data as it passed through Heartland's systems. Prosecutors called it the largest hacking and identity theft case they had ever brought.

    Victim
    Heartland Payment Systems, a US card payment processor
    Happened
    Late 2007 to 2008
    Attributed to
    A US hacker and two accomplices in or near Russia, charged by the US Department of Justice; the US hacker was sentenced to 20 years
    What helps against attacks like this
    • Turn on card alerts and check your statements.
    • Payment firms: encrypt card data end to end and watch servers for unknown software.

The biggest ICS attacks

Attacks that reached industrial control systems, documented in public technical analyses: what happened, how the attackers got in, and what it did to the process.

  1. FrostyGoop / BUSTLEBERM in block letters on a terminal, with the year and the main figure

    Disruption

    FrostyGoop / BUSTLEBERM

    apartment buildings left without heating (Dragos)
    600+
    that the heating stayed off, in sub-zero cold (Dragos)
    ~2 days

    In January 2024, during a sub-zero winter, an attack left apartment buildings in Lviv without heating. The malware, later named FrostyGoop, is a small program that talks to heating controllers over Modbus TCP. This widely used protocol usually asks for no password. FrostyGoop changed the controllers’ settings and downgraded their software so they could no longer report their status.

    Operators lost their view while the controllers ran on wrong values. According to Dragos, the attackers exploited a flaw in an internet-facing router months earlier. They planted a web tunnel reached over Tor and stole Windows credentials. The network was flat, so nothing kept them from the controllers.

    Names
    FrostyGoop (Dragos), BUSTLEBERM (Mandiant)
    Target
    A district heating company in Lviv, Ukraine
    Attributed to
    Not attributed (Dragos saw connections to Moscow-based addresses but does not attribute the attack)
    Way in
    Internet-facing router, Stolen credentials
    Protocols
    Modbus TCP
    Systems attacked
    ENCO heating controllers, reached over Modbus TCP on port 502
  2. Fuxnet in block letters on a terminal, with the year and the main figure

    Destruction

    Fuxnet

    sensor gateways bricked — Claroty's estimate (attackers claimed about 1,700)
    500+
    sensors the attackers claimed destroyed; Claroty believes they likely survived
    87,000

    In April 2024 a group calling itself Blackjack said it had wrecked Moscollector, which monitors Moscow’s underground water and sewage network. Its malware, Fuxnet, ran on the sensor gateways, small Linux computers that collect readings from thousands of underground sensors. On each gateway it cut off remote access, deleted parts of the file system, and rewrote the flash memory until it failed.

    It also flooded the sensor wiring with junk, hoping to damage the sensors too. How Blackjack got in is not documented. The group claimed access since June 2023 and 30 terabytes of wiped data. The security firm Claroty analyzed the malware and the leaked data and puts the damage far lower.

    Names
    Fuxnet (Blackjack)
    Target
    Moscollector, a Moscow company that monitors underground water and sewage infrastructure
    Attributed to
    Blackjack (Claroty says Blackjack is believed to be linked to Ukrainian intelligence; no government has confirmed this)
    Way in
    Not public
    Protocols
    M-Bus
    Systems attacked
    Linux sensor gateways (MPSB and TMSB) and a 3G router, linked to sensors over the M-Bus serial protocol
  3. PIPEDREAM / INCONTROLLER in block letters on a terminal, with the year and the main figure

    Disruption

    PIPEDREAM / INCONTROLLER

    times it was used — the toolkit was found before any attack (Dragos)
    0
    the seventh known piece of ICS-specific malware, by Dragos's count
    7

    PIPEDREAM is a case with no victim. In early 2022 the security firms Dragos and Mandiant analyzed a complete attack toolkit. A state-backed group had built it to find and take over industrial controllers. On April 13, 2022, four US agencies warned of it in a joint advisory. It is the first ICS malware found before an attack.

    The toolkit is modular. Some parts gain deep access to Windows through a signed but flawed driver. Others speak industrial protocols to scan controllers, log into them, reprogram them, or crash them.

    Names
    PIPEDREAM (Dragos), INCONTROLLER (Mandiant)
    Target
    No real victim; Dragos assessed likely targets as liquefied-natural-gas and electricity sites
    Attributed to
    CHERNOVITE (state-sponsored) (Dragos's name for the developer; no country has been named; Mandiant called links to Russia circumstantial)
    Way in
    Not public
    Protocols
    CODESYS, Modbus, OPC UA, Omron FINS
    Systems attacked
    Schneider Electric and Omron PLCs and servo drives, and any OPC UA server; via CODESYS, Modbus, OPC UA, and Omron FINS
  4. Industroyer2 in block letters on a terminal, with the year and the main figure

    Disruption

    Industroyer2

    power outages — the attack was stopped in time (CERT-UA)
    0
    industrial protocol it used, down from four in the 2016 version (ESET)
    1

    On April 8, 2022, the group Sandworm tried to switch off part of Ukraine’s power grid. Its tool was a stripped-down successor to the Industroyer malware of 2016. The addresses of the target substations and the switching commands sat inside the program, so it was built for one utility. Wiper malware was to destroy the utility’s Windows, Linux, and Solaris servers at the same time.

    How the attackers first entered is not public, but they already held administrator rights. They pushed the malware out through Windows Group Policy and set it to run that evening. According to CERT-UA, Ukraine’s incident team, the network had been compromised since at least February 2022.

    Names
    Industroyer2 (ESET), INDUSTROYER.V2 (Mandiant)
    Target
    A Ukrainian electricity utility; its high-voltage substations
    Attributed to
    Sandworm (CERT-UA attributes it to Sandworm (UAC-0082); ESET assesses this with high confidence)
    Way in
    Not public
    Protocols
    IEC 104
    Systems attacked
    High-voltage substation equipment, commanded over the IEC 104 protocol
  5. EKANS / Snake in block letters on a terminal, with the year and the main figure

    Ransomware

    EKANS / Snake

    Windows processes on the kill list, some of them industrial (FireEye)
    1,000+
    sectors Unit 42 named, from energy to healthcare
    5

    EKANS (“snake” backwards) is ransomware that appeared in 2020. It cannot reprogram the controllers that run machinery. Instead it encrypts the Windows PCs from which operators watch and command a plant. First it stops a hard-coded list of programs so their files are no longer locked. These include industrial software from General Electric and Honeywell.

    It also deletes the backup copies Windows keeps. How victims were first breached was never made public. EKANS is the payload dropped at the end. Citing press reports, MITRE ATT&CK links an EKANS infection to a temporary production loss at a Honda plant in June 2020.

    Names
    EKANS (Dragos), Snake
    Target
    Industrial organizations in several sectors, from energy to manufacturing (Unit 42)
    Attributed to
    Not attributed (Criminal ransomware; no government or security firm has named an operator)
    Way in
    Not public
    Systems attacked
    Windows PCs that run the control room (HMIs, historians, and license servers), not the controllers themselves
  6. TRISIS / TRITON in block letters on a terminal, with the year and the main figure

    Destruction

    TRISIS / TRITON

    that the targeted refinery was shut down (CISA)
    several days
    US electric utilities the same actors probed in 2019 (Treasury)
    20

    In 2017, attackers reached the safety system of a petrochemical plant in the Middle East. Its controllers are meant to force a process into a safe state before it turns dangerous. The malware spoke their undocumented protocol, which the attackers had reverse-engineered. With it, the malware wrote a hidden backdoor into a controller’s memory to alter its safety logic.

    How the attackers first broke in is not public. Inside, they reached the workstation that programs the controllers and ran a tool disguised as the vendor’s software. Some controllers tripped and shut the plant down, which is how the malware was found. In 2020 the US sanctioned the Russian institute it holds responsible.

    Names
    TRISIS (Dragos), TRITON (FireEye), HatMan (DHS NCCIC)
    Target
    A petrochemical plant in the Middle East (US agencies say only “a foreign oil refinery”)
    Attributed to
    TsNIIKhM (Russian state institute) (US sanctions name this institute; Dragos tracks the operator as XENOTIME; FireEye assessed it with high confidence)
    Way in
    Not public
    Protocols
    TriStation
    Systems attacked
    Schneider Electric Triconex safety controllers (a safety instrumented system, or SIS), via the undocumented TriStation protocol
  7. Industroyer / CRASHOVERRIDE in block letters on a terminal, with the year and the main figure

    Disruption

    Industroyer / CRASHOVERRIDE

    power cut to part of Kyiv (ESET)
    ~1 h
    grid protocols the malware could speak
    4

    On December 17, 2016, part of Kyiv lost power for about an hour. The malware behind it, analyzed in 2017, was the first built to control grid equipment directly. Instead of a person clicking through remote-control tools, its modules opened circuit breakers on their own, over the grid’s standard protocols. How the attackers first got in was never established.

    A launcher set off the payload at a chosen time. One to two hours later, a wiper destroyed files and settings to slow recovery. A separate tool could disable Siemens SIPROTEC protection relays. Dragos tracks the operators as ELECTRUM.

    Names
    Industroyer (ESET), CRASHOVERRIDE (Dragos)
    Target
    A Ukrainian electrical transmission company; part of Kyiv lost power
    Attributed to
    Sandworm (GRU) (US government attribution; ESET did not attribute it in 2017)
    Way in
    Not public
    Protocols
    IEC 60870-5-101, IEC 60870-5-104, IEC 61850, OPC DA
    Systems attacked
    Substation breakers and relays, via the grid protocols IEC 60870-5-101/104, IEC 61850, and OPC DA
  8. BlackEnergy in block letters on a terminal, with the year and the main figure

    Disruption

    BlackEnergy

    customers lost power (US DHS)
    225,000
    to restore power by hand (INL)
    ~6 h

    On December 23, 2015, three Ukrainian power companies lost control of their grids within about half an hour. It is the first blackout confirmed to have been caused by a cyberattack. Months earlier, phishing emails with macro-laden Office files had planted the BlackEnergy malware on their office networks.

    With stolen credentials, the attackers used the utilities’ own VPN and remote-control tools to reach the control systems. There they opened breakers at more than 50 substations. They also disabled serial-to-Ethernet converters, wiped PCs with KillDisk, and flooded a call center, so power had to be restored on site.

    Target
    Three regional power distribution companies in Ukraine
    Attributed to
    Sandworm (GRU) (US government attribution; in early 2016 analysts could not yet name the operators)
    Way in
    Phishing email, Stolen credentials, VPN access
    Systems attacked
    SCADA control systems reached by remote-access tools; substation serial-to-Ethernet converters
  9. Havex in block letters on a terminal, with the year and the main figure

    Espionage

    Havex

    known victims worldwide (Kaspersky)
    2,800+
    victim organizations identified by name
    101

    Havex, made public in June 2014 and also tracked as Dragonfly or Energetic Bear, was a spying campaign against the energy sector. It came through phishing emails, rigged websites, and, most notably, hacked download pages. At least three small makers of industrial software had their installers swapped for versions that carried Havex.

    The backdoor downloaded extra modules. One searched the network for OPC servers and sent their details to the attackers. The scanning alone crashed some servers. Havex stole information but carried no sabotage payload.

    Names
    Havex, Backdoor.Oldrea (Symantec)
    Target
    Energy companies and makers of industrial equipment, mostly in the US and Europe
    Attributed to
    FSB (Russia) (In 2014 security firms suspected a state actor; the US named Russia's FSB in 2022)
    Way in
    Phishing email, Compromised website, Supply chain
    Protocols
    OPC
    Systems attacked
    OPC servers, the Windows middleware that exposes live plant data to other software
  10. Stuxnet in block letters on a terminal, with the year and the main figure

    Destruction

    Stuxnet

    centrifuges taken out of service at Natanz (ISIS estimate)
    ~1,000
    computers infected worldwide by September 2010
    100,000

    Stuxnet, found in June 2010, is the first malware known to have damaged physical machines. It spread to more than 150 countries but was built for one target, a uranium-enrichment plant in Iran. The plant’s control network had no internet connection, so the worm most likely came in on a removable drive. It then spread through four unknown Windows flaws and the project files of Siemens Step 7.

    Hidden code on the Siemens controllers ran the centrifuge motors far outside their normal speed, while operators saw normal readings. An institute estimated that about 1,000 of 8,692 centrifuges were taken out of service. The link to Stuxnet is unproven. Press reports describe a joint US-Israeli operation.

    Names
    Stuxnet, Rootkit.TmpHider (VirusBlokAda), W32.Temphid (Symantec)
    Target
    A uranium-enrichment plant in Iran, linked by researchers to Natanz
    Attributed to
    Not officially attributed (No government has confirmed it; the attribution rests on press reports)
    Way in
    Removable media
    Protocols
    Profibus, Siemens S7
    Systems attacked
    Siemens S7-300 controllers and their frequency-converter drives, via Step 7 and WinCC software
How far each attack got along the kill chain
NameStage 1: intrusionStage 2: attack on the industrial process
Stuxnet 2010 5 / 8 4 / 5
Havex 2014 7 / 8 0 / 5
BlackEnergy 2015 4 / 8 4 / 5
Industroyer / CRASHOVERRIDE 2016 2 / 8 4 / 5
TRISIS / TRITON 2017 1 / 8 4 / 5
EKANS / Snake 2020 0 / 8 2 / 5
Industroyer2 2022 1 / 8 2 / 5
PIPEDREAM / INCONTROLLER 2022 0 / 8 1 / 5
Fuxnet 2024 1 / 8 4 / 5
FrostyGoop / BUSTLEBERM 2024 4 / 8 3 / 5

Each bar counts the steps of a stage that public reports describe for the attack. A short bar can also mean that a step is not documented.

How an attack gets on this list

Thousands of attacks become public every year. The list of IT attacks keeps only those with the largest impact. An attack is listed if it meets at least one of three criteria. The figure must come from the victim, an authority, a regulator, or a court, not only from the press or the attackers.

CriterionMet when
Lossat least 500 million US dollars were stolen or lost, at the value at the time; the victim’s own costs count
Datadata of at least 100 million people, user accounts, or payment cards was taken or published
Outagecritical services such as health care, energy, transportation, telecom, or payments failed at the national level for at least a day

Attacks on industrial control systems are listed when they reached or targeted the control of a physical process, such as a power grid or a plant. Public technical analyses document each of them.

Attacks that spread through a known vulnerability, such as WannaCry and NotPetya, are on the list of vulnerabilities.

The measures on the cards of the IT attacks help against attacks of that kind. They are not a claim that they would have stopped that attack.

Known, but not on the list

NameYearWhy not
Jaguar Land Rover2025Car production stopped for about five weeks. Making cars is not a critical service, and the costs booked so far, 196 million pounds, are below the threshold.
Ascension2024Hospitals worked on paper for weeks, but in one hospital group, not a national service. Data of 5.6 million people was taken.
Poly Network2021About 610 million US dollars in tokens were taken, but the attacker returned them within two weeks.
SolarWinds2020Espionage through a tampered update that fewer than 18,000 customers installed. No confirmed loss, data count, or outage reaches the thresholds.
Mt. Gox2014About 850,000 bitcoin went missing, and 200,000 of them were found again. At the time, the rest was worth less than 500 million US dollars.
Target2013About 40 million payment cards and the contact details of up to 70 million people: below 100 million.