Devices and control systems: Energy and utilities, Ukraine 2024
Using the FrostyGoop malware, attackers sent Modbus commands directly to controllers of a district heating supplier in Lviv.
- Incident · 2024 · Lviv, Ukraine
- Evidence: one media report
- Devices and control systems
- Malware
As of
What happened
The controllers delivered false readings and failed, and customers had no heating for two days. Dragos discovered the malware in April 2024.
- Affected
- Company (anonymous)
- Industry
- Energy and utilities
- Loss
- no reliable figure
- Business interruption
- 2 days
- Ransom demanded / paid
- no / no
- Data affected
- unknown
- Bankruptcy
- no
- Entry point
- Internet-accessible control systems (Modbus TCP, port 502)
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Loss of income after an attack
Business interruption, only after the waiting period
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Property damage caused by an attack
Spoiled goods, damaged machine
Mostly not covered 0 of 9 business products cover it fully, as an add-on or with limits.
-
Third-party claims after a data breach
Liability for data protection and network security breaches
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Temperature control systems can be manipulated directly from the internet via open industrial protocols.
Sources
- Protect Against FrostyGoop ICS Malware Targeting Operational Technology (opens in a new window) Dragos
«resulted in a two-day loss of heating to customers»