Ransomware Recovery Readiness for a Water Authority
Billing, SCADA historians and plant engineering restored from clean copies in under 30 hours during a live drill.
Client name withheld by agreement- Client
- Regional water and wastewater authority
- Region
- Phoenix, Arizona
- Year
- 2025
- Duration
- 18 weeks
- Scope
- 11 treatment plants · 64 pump stations · 1.8M residents served
- Practice
- Offensive Security & Resilience
The challenge
What was at stake.
A regional water and wastewater authority serves 1.8 million residents from eleven treatment plants and 64 pump stations. Its IT and plant networks shared more connections than anyone had documented, and backups had been tested one server at a time.
Federal guidance and a peer utility’s ransomware incident made the board ask how long the authority could run treatment, billing and lab reporting if IT went dark.
What we did
The approach, step by step.
- 01
Connections between IT and plants found
Passive monitoring and firewall review uncovered 23 undocumented paths from the business network to plant systems, each closed or brought under control.
- 02
Recovery tiers agreed
Operations, finance and compliance ranked systems by how long the authority can go without them, from SCADA historians to customer billing.
- 03
Clean copies that attackers cannot reach
Immutable, offline-capable backups and an isolated recovery environment were stood up for every tier-one system.
- 04
Live recovery drill
A timed exercise restored billing, historians, engineering workstations and the lab information system from clean copies, without touching running plant controls.
- 05
Manual operations rehearsed
Plant supervisors practiced running on local control and paper logs, and the communications team rehearsed public and regulator notices.
Outcomes
What changed, in numbers.
- Under 30 hrs
- to restore tier-one systems in a live drill
- 23
- undocumented IT-to-plant connections closed
- 11
- treatment plants assessed without disruption
- 0
- interruptions to water service during testing
We used to say we had backups. Now we can tell the board exactly how many hours it takes to come back.
Services delivered
Related engagements
More work in Offensive Security & Resilience.
-
Irving, Texas · 7 weeks
Offensive Security & Resilience · 2026Digital Ordering Penetration Test for a Restaurant FranchisorA loyalty-points fraud path worth millions closed before the national rewards relaunch.
-
Charlotte, North Carolina · 26 weeks
Offensive Security & Resilience · 2026 · OngoingUnified Controls and Audit Program for a Wealth-Tech Platform612 overlapping requirements folded into 148 owned controls, and one evidence cycle for four audits.
-
Plano, Texas · 11 weeks
Offensive Security & Resilience · 2024Cyber Crisis and Continuity Readiness for a Mortgage ServicerBorrower payments kept posting in a simulated loss of the servicing platform, with every decision owner named in advance.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.