Cyber attacks on critical infrastructure can cause significant operational downtime and financial loss, both to the provider itself and for the many customers that rely on the supplier for critical services such as power, water and internet.
One of the more recent reminders of this risk came in July 2024 when hackers targeted internet service provider (ISP) networks across the US, disrupting the operations of millions of commercial and personal customers.
A single, more targeted attack can also have major ripple effects due to the interdependency within critical infrastructure sectors. A ransomware attack on energy giant Colonial Pipeline in May 2021 caused widespread fuel shortages and a commodity price spike, affecting truck fleets, filling station customers and airline operators across multiple US states.1
And the February 2024 data breach of a large health-tech provider impacted billing, insurance processing and access to care for hospitals, pharmacies and medical practices across the US, ultimately affecting around 190 million people.2
In a world where so much of our day-to-day operations depend on the critical infrastructure sectors to function, the impact of a disruption can be felt far and wide, with implications for safety, security and economic stability.
What is critical infrastructure?
- Energy
- Transport systems
- Air and seaports
- Health
- Drinking water
- Crisis response
- Food and agriculture
- Waste water and water management
- Space
- Certain central public administrations
- Critical manufacturing
Domino effect in an interconnected era
When critical infrastructure is the target of a cyber intrusion, the impact is widespread. For example, disruption to communication networks, power outages across the electric grid and transportation gridlocks can cause substantial business interruption across multiple industry verticals.
The ongoing digitization of modern economies has exacerbated these interdependencies. With growing reliance on cloud services, for instance, the consolidation among providers has increased the risk of a single supplier outage having a global impact. The lack of cloud provider diversification is a factor that came into sharp relief in 2024 due to the CrowdStrike IT outage, which was the results of a faulty update rather than a cyber attack. In total, there were six significant cloud outages over the course of the year.3
Meanwhile the attack perimeter is also expanding. The growth in the number of connected devices, known as the Internet of Things (IoT), means that hacking a specific device — something as innocuous as a smart thermostat or webcam — could provide a point of entry into a company's wider network.
The challenge with many original connected devices is that consumer appeal took precedent over security. The weaponization of devices during distributed denial of service (DDoS) attacks has highlighted this vulnerability, and newer generations have been designed with more robust security in mind.4
Why critical infrastructure is a target
Critical infrastructure is an attractive target for cyber attacks because of its inter-relationships with nearly all sectors of business, government and society. It's the infrastructure underpinning economies, so a successful attack is likely to cause a big impact, enabling attackers to make a name for themselves in the criminal world in which they operate.
For politically motivated hackers, disruption to critical systems is designed to unleash chaos — threatening public safety and social cohesion.
State-sponsored attacks often stem from geopolitical conflicts, reflecting the shift from physical to cyber warfare as hackers seek to cause disruption and gather intelligence.
Where attack groups cast a wide enough net, critical services can also be among the many victims caught in it. The latter scenario has been a particular feature of ransomware attacks, including WannaCry and NotPetya, which counted e-commerce providers, major shipping firms and healthcare services among their victims.
Such attacks may deliberately target essential services, to cause the greatest disruption and focus media attention. The healthcare sector accounted for nearly a quarter of all data breaches in 2024.5 Digitization of the sector has increased its vulnerability to cyber attacks, and facilities are often targeted because the protected health information they hold is extremely valuable and can be readily sold or exploited.
A shifting focus to operational technology exposures
Protecting people and systems means staying informed and keeping up in the arms race against malicious actors. This protection includes investing in automated vulnerability assessments and intrusion detection, while also training staff to be a vigilant frontline of defense.
The challenge for businesses in industrial sectors that rely on operational technology (OT) is coping with legacy systems that are costly to update. But with the OT landscape becoming more interconnected, updating systems has become even more challenging.
The preponderance of aging OT dramatically increases vulnerability to cyber attack. Whereas once such systems could rely on the "air gapping" defense — whereby a computer or network is isolated with no connection to outside networks — this practice is becoming more difficult.
"Ultimately, it's crucial to consider how to segregate these systems and build an IT infrastructure to ensure it remains isolated from the broader network and not connected to the Internet," says Aldo Borsani, Gallagher's head of Cyber, Europe. "However, you will still need some level of connectivity in operational technology for management and control purposes."
He adds, "The Internet of Things adds complexity to the situation and, specifically within the OT environment, risks associated with cyber threats become even more pronounced."
