Encryption reported across the Hydronex estate
At 05:42 on Monday morning, Hydronex Systems requests urgent assistance following a major cyber incident affecting its Windows servers and workstations.
The organization declared the incident at approximately 04:37. Files have been encrypted, several systems are unavailable and backup services are no longer responding. Administrators report unusual privileged authentication, abnormal SMB traffic and a ransom note on multiple machines.
Hydronex supplies automation, monitoring and engineering technology to the water sector. Its technology and services are used by utilities serving approximately 80% of the country's population. Several engineering resources are unreachable; the extent of customer exposure is unknown.
Current assessment. There is no confirmed evidence of physical disruption to water treatment or distribution.
Your team has been assigned the available endpoint, network, identity and engineering evidence. Hydronex cannot yet establish the entry point, the duration of the intrusion or whether information left its network.
Questions for the response team
- When did the intrusion begin, and how was access obtained?
- Which identities and systems were involved?
- What information was collected or transferred?
- Did the activity reach operational technology, and what impact can be demonstrated?
Begin with the available challenges. Further lines of investigation open as you progress.