SCADA system

On December 23, 2015, attackers attributed to Sandworm took over the control workstations of three Ukrainian power distribution companies and remotely opened breakers, cutting power to about 225,000 customers for several hours. It was the first confirmed blackout caused by a cyberattack, set up through months of spear phishing and reconnaissance. SCADA (Supervisory Control and Data Acquisition) refers to the systems that monitor and command physical processes in real time: power grids, chemical plants, water treatment, pipelines, rail. They combine programmable logic controllers (PLCs), human-machine interfaces (HMIs) and data collection servers wired to sensors and actuators. Securing them works differently from corporate IT. Lifecycles run 15 to 30 years, and nobody shuts down a production unit to apply a patch. Built for isolated, air-gapped networks, they have few native defenses, and hooking them up to the corporate IP network made them reachable from the internet. Triton/TRISIS, found in 2017 at a Saudi petrochemical plant, went after the safety instrumented system itself, the layer meant to prevent the accident. For insurers, a SCADA loss falls between two policies. The damage is physical, the cause is cyber: does the property policy carry a cyber exclusion such as CL380 (Institute Cyber Attack Exclusion Clause, 2003), and does the cyber policy exclude physical damage? Since Lloyd's July 2019 bulletin on silent cyber, every policy in that market has to state whether it covers or excludes cyber, and causation gets decided in that wording.