FBI traces 800 staged SCADA files to a U.S. ICS integrator's own network

Nine .zip archives, roughly 800 files: customer SCADA information, ICS device details and other schematics ^[7]. That averages about 89 files per archive ^[8]. The FBI describes the bundles as created "for presumed exfiltration" ^[7], so what the agencies document is collection and packaging on the victim's network, not confirmed transfer off it. The fact sheet identifies the intruders only as malicious foreign cyber actors and does not name the company ^[10].

The access these firms hold is the subject. FBI and CISA list what third-party integrators do inside ICS environments: control system design, installation, operational data analysis, device support and service, and daily operational control ^[4]. Each of those jobs comes with credentials. The agencies' recommendation is to size them down, and they define least privilege in OT as granting users, processes and systems "only the minimum access necessary to perform their assigned tasks, and no more" ^[3]. Skip it, the fact sheet says, and owners may hand actors sensitive access to pathways they can exploit to cause disruptive and destructive effects to equipment and critical functions ^[14].

The recommendation aims at paperwork, not products. Owners should routinely reassess contracts that involve access to industrial systems and judge the effect on their own data autonomy and process controls ^[11]. The same assessments should cover hardware and software supply chain vulnerabilities introduced by integrator equipment, plus the IT and OT security of those devices and their associated networks ^[12]. Where design work is contracted out, the obligation runs both ways: integrators and owners have to collectively enforce clear requirements for the secure procurement and handling of system components ^[15].

Integrators that operate and host data outside the United States get separate treatment, on the grounds that they may be subject to different data storage and management laws that do not meet the security needs of U.S. critical infrastructure entities ^[13]. Foreign-owned integrators also draw a geopolitical line into the risk assessment ^[17].

This is a fact sheet of considerations, with no binding requirement and no compliance date ^[16]. Its use to an asset owner is evidentiary. The next time an integrator asks for high levels of access or control over a physical process ^[2], there is a dated federal case to cite in which the contractor's network was the route to power utility and transportation customers' schematics ^[5][7].