Key takeaways
- Most utility incidents compromise IT systems, not the industrial controls themselves.
- The file shares hold the most operationally sensitive documents a utility owns.
- Small operators are targets too — attackers scale across the sector’s long tail.
Critical-infrastructure security conversations gravitate to operational technology: the controllers, the relays, the air gaps. That focus is deserved, but it can obscure where incidents actually begin. Utility compromises overwhelmingly start and often end on the IT side — business systems, email, and above all the ordinary file servers holding the organization’s institutional knowledge.
Consider what accumulates on a utility’s shares: one-line diagrams, substation drawings, SCADA and relay documentation, emergency procedures, vendor credentials in spreadsheets, decades of customer records. An attacker does not need to touch a controller to create leverage; encrypting or publishing that archive is disruption enough, and the reconnaissance value of the engineering documentation alone makes utilities a standing collection target.
The long tail is the target surface
The sector is not a handful of giants; it is thousands of cooperatives, municipals, and districts running lean IT teams. Extortion crews understand this and scale horizontally — the ransom demand adjusts to the victim, but the playbook is identical. Florida Keys Electric Cooperative lived this arc: hit by ransomware in 2015, watching peers and neighbors targeted since, and ultimately deciding the file layer itself had to be able to detect and stop an attack rather than hope the perimeter held.
What resilient looks like at a utility
The pattern that works for lean teams is consolidation rather than accumulation: storage that detects and stops malicious file activity on its own, holds immutable recovery points, keeps the audit trail regulators ask for, and does not require a 24/7 security staff to operate. For the operators keeping power and water moving, the file share should be the most defended system they own, not the least.