TL;DR
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Bloomberg’s reporting, summarized by Meduza, describes attacks linked to Russia on industrial control systems at water facilities, factories and food businesses in Europe and the United States. Incidents included disrupted water supplies, spoiled meat and interference with factory equipment; investigators and cybersecurity officials say weak security has made systems vulnerable. Responsibility for some incidents is claimed or alleged, and some individual accusations are denied.
Russia-linked hacker groups have used weakly secured industrial control systems to disrupt water facilities, factories and food businesses in Europe and the United States, according to a Bloomberg report summarized by Meduza on October 28. The reported incidents include burst water pipes, spoiled food and malfunctioning factory equipment, highlighting how exposed operational technology can create physical risks beyond computer networks.
The incidents described span several countries and types of infrastructure. In Denmark in December 2024, a control system at a village water facility was allegedly manipulated: the pressure setting was reduced to zero, cutting off water to about 450 homes, and then pressure surged the following day, bursting underground pipes. The controller’s manufacturer, Evotect ApS, determined that the system had been hacked, according to the report. A local water committee chair said the system’s password was 1234.
In the United States in 2024, hackers reportedly disabled refrigeration at a meatpacking plant near Los Angeles, spoiling more than 2,000 pounds of meat; an ammonia leak led workers to evacuate. Other reported incidents involved altered settings at a Texas water system, where an unknown volume of water spilled from storage tanks, and tampering with equipment at a Pennsylvania wastewater treatment facility used to kill bacteria.
Bloomberg also described incidents in Spain from late 2024 to summer 2026, including disruptions to crematorium ovens, transformer-manufacturing equipment and winery heating and ventilation systems. A fire broke out at the Catalonia factory, and two wineries suspended operations after temperatures rose in production and storage areas. The report attributes activity to groups including Cyber Army of Russia Reborn (CARR) and Z-Pentest, but public claims of responsibility and allegations by authorities do not establish that every incident was carried out by those groups.
Weak Controls Can Disrupt Essential Services
Industrial control systems operate physical processes such as water pumping, refrigeration, heating and wastewater treatment. When their settings or access are compromised, the result can reach beyond data loss: homes can lose water, food can spoil, workers may need to evacuate, and equipment or facilities can be damaged. The examples in the report show that relatively ordinary systems can have consequences for public health, local services and business operations.
The reported attacks also illustrate a defensive challenge. According to the experts cited by Bloomberg, attackers need not use especially sophisticated methods if internet-connected systems have weak passwords or other security gaps. Opportunistic targeting means the risk is not limited to nationally prominent infrastructure: a poorly protected local facility may also be exposed. That does not mean every reported disruption caused lasting harm, and the available account does not quantify the total damage across incidents.
Products Worth Considering
Dell UltraSharp U2725QE 27-Inch 4K UHD IPS Black Monitor
Dell UltraSharp 32 U3226QER 4K Thunderbolt Hub Monitor
Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit
As an affiliate, we earn on qualifying purchases.
Groups, Claims and Investigations
Bloomberg identifies CARR as a group linked to Russia’s military intelligence agency, the Main Directorate of the General Staff, formerly known as the GRU. It has publicly claimed attacks on facilities in Europe and the United States, and its members are under U.S. and European Union sanctions. Z-Pentest was formed in September 2024 by members of CARR and NoName057(16). The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has said some CARR members broke away, citing dissatisfaction with the level of support from the GRU; the EU has sanctioned Z-Pentest and holds it responsible for attacks on critical infrastructure, particularly in energy and water.
The report also discusses criminal cases, which remain allegations rather than findings of guilt. Ukrainian citizen Victoria Dubranova was charged by the U.S. Justice Department in late 2025 with working for CARR and Z-Pentest. She is in custody and denies the charges. The department alleges she helped identify targets and produced videos for hackers; Z-Pentest has said she did not hack systems. Italian citizen Chris Barlati, arrested in Spain in March, has pleaded not guilty to allegations that he acted as an intermediary and helped select targets. He is not currently in police custody, according to the source material.
“I am genuinely surprised that we haven’t yet seen a catastrophe.”
— Cian Heasley, principal consultant at Acumen Cyber
Attribution and Damage Still Vary
The source account does not provide a complete accounting of which group was responsible for each incident, or independently establish that all attacks described were directed by the Russian state. CARR and Z-Pentest have made public claims about some operations, while U.S. and European authorities have linked groups to attacks and imposed sanctions. Those claims and official assessments should not be treated as proof that a particular group caused every disruption.
The full scale of physical and financial damage is also unclear. The report gives a figure for spoiled meat and a count of homes affected in Denmark, but does not state the volume of water lost in Texas or offer a combined estimate for losses across the incidents. The criminal allegations against Dubranova and Barlati remain contested; both deny or have pleaded not guilty to charges, as applicable.
Security Reviews and Cases Continue
The reporting points to basic security measures—including stronger passwords and tighter access to industrial control panels—as immediate areas for facility operators to review. The source material does not identify a single new government action or a scheduled policy milestone arising from the report. Further public details may come from cybersecurity agencies, affected operators and ongoing legal proceedings, but no timetable is provided.
Readers should watch for verified incident reports that clarify attribution, operational effects and whether systems have been restored or secured. The status of the U.S. cases involving Dubranova and Barlati may also change as proceedings continue; the allegations remain subject to legal process.
Key Questions
What happened in the reported attacks?
Bloomberg’s report describes hackers disrupting industrial systems at water facilities, factories and food businesses. Reported effects include a water outage and burst pipes in Denmark, spoiled meat and an evacuation in the United States, and equipment or ventilation disruptions in Spain.
Who is believed to be behind the activity?
The report discusses CARR and Z-Pentest, groups linked or attributed to Russia by U.S. and European authorities. Some groups have publicly claimed attacks, but the source material does not establish that they were responsible for every incident described.
Were the systems highly sophisticated targets?
The experts cited say many incidents involved poorly secured systems and that attackers can cause harm without advanced techniques. The report gives the Danish controller’s password as 1234, but does not describe the security configuration of every affected system.
Have the accused individuals been convicted?
No conviction is reported in the source material. Victoria Dubranova denies the U.S. charges, and Chris Barlati has pleaded not guilty. The allegations remain unresolved.
What is not yet known about the incidents?
The overall damage, water volume lost in Texas, and precise responsibility for each attack remain unclear in the available account. It also does not provide a complete picture of system recovery or security changes at every affected site.
Source: meduza.io
