F1000Research F1000Research 2046-1402 F1000 Research Limited London, UK 10.12688/f1000research.180098.1 Case Study Articles Developing Cybersecurity Awareness in 9 th –12 th Grades Students through Scenario‑Based Learning

[version 1; peer review: awaiting peer review]

 Vajpayee Prashant Conceptualization Data Curation Formal Analysis Investigation Methodology Project Administration Resources Supervision Validation Visualization Writing – Original Draft Preparation Writing – Review & Editing https://orcid.org/0009-0006-1285-6676 a 1 Eze Esther Conceptualization Data Curation Formal Analysis Investigation Methodology Writing – Original Draft Preparation 1 Raheem Tayiba Conceptualization Data Curation Formal Analysis Investigation Methodology Writing – Original Draft Preparation 1 Meka Sri Durg Nivedith Conceptualization Data Curation Formal Analysis Investigation Methodology Writing – Original Draft Preparation 1 Khan Fayezuddin Mohammed Validation Visualization 1 Hossain Gahangir Funding Acquisition Project Administration Validation Writing – Original Draft Preparation Writing – Review & Editing b 1 College of Information, University of North Texas, Denton, Texas, USA prashantvajpayee@my.unt.edu Gahangir.Hossain@unt.edu

No competing interests were disclosed.

 1 6 2026 2026 15 852 4 5 2026 Copyright: © 2026 Vajpayee P et al. 2026 This is an open access article distributed under the terms of the Creative Commons Attribution Licence, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited. Background

In the era of accelerating Agentic AI, critical infrastructure sectors have become increasingly vulnerable as they are interconnected with multiple internal and external systems. Furthermore, the growing use of the internet for digital education and activities such as gaming and social media has made students a soft target for attackers. Due to the lack of cybersecurity and cyber-risk education, there is a nationwide scarcity of cyber talent. The motivation for this research is threefold: to protect student identities given their significant online activity, to enable cyber literacy among teachers and students in Grades 9–12 to help develop a cyber-aware future workforce, and to build awareness of cyber risks through real-time case studies so students can understand critical infrastructure and the safety considerations associated with it.

 Methods

We developed nine case studies across various domains—transportation, supply chains, healthcare, agriculture, manufacturing, AI data centers, energy infrastructure, water utilities, and banking and finance. Each case study follows a standard structure that includes a scenario overview, key assets at risk, a threat event, and impact analysis across multiple dimensions, a simplified risk-analysis model suitable for high-school learners, and diagrammatic representations for summarization.

 Results

These realistic use cases across diverse domains provide comprehensive insights into real-world scenarios and recommended best practices. Teachers can use them to demonstrate layered defense, cyber-risk reduction, and cyber-resilience strategies. The case studies can be easily integrated into STEM, technology, and cyber-career-readiness curricula.

 Conclusion

This research provides a scalable, reusable, and pedagogically sound approach to building cyber literacy among high-school students. The case studies across critical-infrastructure domains help students understand the importance of cyber resilience and the interdisciplinary nature of digital risk. The framework can be extended to hands-on labs, simulations, and learning modules, contributing to national efforts to strengthen cybersecurity awareness and workforce readiness.

 Cyber Literacy K-12 Cybersecurity for High School Students Risk Analysis Critical Infrastructure Security Cyber Resilience Cyber Awareness STEM Cyber Curriculum Threat Modeling ONR OfficeofNavalResearch(ONR) USA AwardNumberN00014-23-1-245 This work has been partially supported by the Office of Naval Research (ONR), USA, Award Number N00014-23-1-245 The funders had no role in study design, data collection and analysis, decision to publish, or preparation of the manuscript. Case Studies Cybersecurity case study: Road and highway cybersecurity

Scenario overview

During early 2018, the Colorado Department of Transportation (DoT) was impacted by a large-scale cyberattack, which included distributed denial of service (DDoS) style to network flooding followed by service disruption. The attack forced Colorado DoT to turn off 2000+ computers, including systems connected to highway operation, traffic management servers, roadway monitoring systems, and maintenance scheduling. Though no attack occurred on the traffic lights, the supporting IT infrastructure was hacked to manage road and highway operations. This is a great example of how DDoS attacks can hamper transportation operations without interacting a single traffic light directly.

Key assets at risk

The attack affected the road and highway operations significantly by impacting the following assets.

Offline Traffic Management System: The entire traffic management system went offline, which paused real time traffic monitoring, incident response reporting system, roadway camera feeds, and congestion prediction tools.

Paused Roadside Communication: The attack disrupted the communication between roadside units, highway sensors, and variable message signs.

Paused updates to Digital Signs: CDoT wasn’t able to update warning signs, speed advisories, construction alerts, and weather hazard messages.

Delayed Emergency Response and Maintenance: Along with emergency response routing, the road repair schedule messages and snow-plow operations were delayed.

Threat event

A large botnet starts flooding the state’s highway traffic-management servers of Colorado DoT with millions of fake requests every second. Due to these messages, the servers become overloaded and stop responding. Due to this service disruption in the centralized traffic management system, the traffic cameras go dark, digital signs freeze, and toll gates malfunction. Furthermore, drivers no longer receive warnings about accidents, speed advisories, construction warnings, and weather hazards. Apart from this, the Emergency responders cannot access real-time road conditions too. Highways and roads become congested and unsafe because the digital systems that normally manage traffic went offline. As an outcome, the transportation agency had to shut down parts of its network and switch to manual operations while cybersecurity teams worked to resolve the attack impact.

Impact analysis

Operational

Due to the shutdown of 2000+ computers, the entire traffic management system was heavily impacted along with monitoring and maintenance service. It created a huge backlog for manual processes, delaying all transpiration workflows.

Safety

The shutdown of traffic management services, roadway monitoring, and stale operational dashboards reduced situational awareness for transportation staff. It increases safety risk with emergencies such as traffic jams, weather hazards etc. Due to lack of visibility, the operator cannot send the crews timely.

Financial

Flight Colorado State paid around $1.5 million recovery cost for system restoration and external support. Furthermore, Colorado’s financial systems, which process around ~$100 million payments every month were heavily disrupted, enforcing manual workflow for business continuity.

Reputational

This attack event became a case study at a national level in the category of critical infrastructure vulnerability. Public reports highlighted how the vulnerabilities and weak control could cause significant harm to critical infrastructure. This incident generated concerns about CDOT’s cybersecurity ecosystem and increased queries from government, media, and public.

Cyber risk awareness/quantification

For the ease of explanation, the traffic light metaphor is used for cyber risk quantification. The three signal approach has been used to assign risk scores.

Green light indicates system is working business as usual (score 0–2)

Yellow light reflects warning sign (score 0–3)

Red light indicates complete suspension (score 0–5)

For CDOT’s case study, we can map the traffic light colors to provide risk evaluation.

Green: 0 (Systems were not functioning perfectly)

Yellow: 3(Warning signs ignored: misconfigured server)

Red: 5 (Shutdown of 2000+ computers)

Total Risk Score = 8/10 (Critical risk).

Best practices/mitigation

Network segmentation: Network segmentation strategy will be helpful to decouple the network zone, which is impacted by malware. It will reduce the expansion of the attack.

Deploy endpoint detection and response (EDR): By deploying EDR, the unusual behaviour, anomalies, and ransomware activity can be tracked real time.

Connected backup: Regular backup can help to recover data post compromise and reduce data loss. Also, the backup should be disconnected from the main network to avoid attack impact.

Continuous vulnerability scanning and patching: Regular vulnerability scanning and resolution will help make systems cyber safe. Furthermore, the patching of software applications to its latest version will strengthen the cyber assets’ security.

Practice cyber incident response exercise: To maintain business continuity, it is recommended to simulate cyber incident scenarios and execute recovery steps to determine gaps. It will help to improve the system recovery process consistently.

Diagrammatic representation of case study

This above Figure 1depicts the series of events in a DDoS attack targeting transportation infrastructure, illustrating the effect of network flooding to traffic management systems, roadside communications, and digital signage that lead to inefficiency and increase risk factors .

Key terms and definitions

The following terms available in Table 1 have been used throughout this case study. Each definition is written in plain language for easy understanding.

Road and highway cyberattack flow (DDoS Scenario)- This diagram depicts the series of events in a DDoS attack targeting transportation infrastructure, illustrating the effect of network flooding to traffic management systems, roadside communications, and digital signage that lead to inefficiency and increase risk factors. Key terms used in the case study “cybersecurity case study road and highway cybersecurity”.
Term Definition
DDoS (Distributed denial of service) A cyberattack that floods a system with fake traffic so it can’t respond to real users.
Botnet A network of infected computers controlled by attackers to launch large-scale attacks.
Service disruption When a system stops working because it is overloaded or damaged.
Malware Harmful software designed to damage or disable systems.
Attack vector Any data that can be used to identify a particular person - a name, address, date of birth, Social Security number, etc.
Vulnerability A weakness in a system that attackers can exploit.
Misconfigured server A server set up incorrectly, making it easy for attackers to access.
Network segmentation Splitting a network into smaller zones to stop attacks from spreading.
Endpoint detection & response (EDR) Tools that detect suspicious activity on computers.
Offline backup A backup stored away from the main network for attack protection
Vulnerability scanning Checking systems for weaknesses that need fixing.
Patch management Updating software to fix security flaws.
Incident response plan A step-by-step plan for handling cyber emergencies.
Cybersecurity case study: Transportation and supply chain

Scenario overview

GPS spoofing is the act of sending false GPS signals to mislead a GPS receiver about its actual location. This paper refers to a case study that shows how GPS spoofing has become a major problem for air traffic. It has become a prominent global issue. Since September 2023, civil aviation has been significantly impacted because of this. In a single month, from July 15 to August 15, 2024, a total of 41,000 flights experienced spoofing incidents across the globe. A report reflects a clear rise in spoofing incidents starting from April 2024, based on algorithms applied to ADS-B data. However, not all spoofing incidents can be detected this way, so the true number could be significantly higher.

GPS spoofing is a technique that manipulates a GPS receiver by sending fake signals, causing the device to display an incorrect location. The impact is broader and not limited to air travel. It can affect navigation systems, drones, vehicles, and smartphone navigation apps, which can lead to misdirection, theft, and increased security risks.

Unlike jamming, which blocks GPS signals, spoofing actively deceives the receiver by providing stronger, fake signals that override legitimate satellite data.

Key assets at risk

While GPS spoofing is primarily associated with navigation and positioning systems, its impact is also seen on time-dependent assets and on operational and economic assets. The following Table 2 reflects the list of assets and their corresponding mapping.

Threat event

The case studies explain how threat events occur step by step. The steps are as follows:

Attack transmits fake GPS signals towards an aircraft during flight.

The aircraft’s GPS receiver considers the fake signal as a stronger spoofed signal and sends false position, altitude, and time data.

This corrupted information is automatically propagated with different sub systems Flight management systems (FMS), IRS (Inertial Reference System), and Enhanced Ground Proximity Warning System (EGWPS) through ARINC 429 data bus.

The FMS evaluated the aircraft’s position based on incorrect GPS Data, causing the aircraft to shift from its intended route while still reflecting authentic navigation.

The IRS system consumes the false GPS updates, reinforcing the erroneous position.

Enhanced GPWS, depending on GPS-derived false altitude, produce false terrain warnings or fail to warn on realistic obstacles.

The flight staff remains unaware of the spoofing event because all the systems fastly show normal functions.

The aircraft continues to travel on an unsafe or unintended path, with downgraded situational awareness and compromised terrain-avoidance protection system.

Impact analysis

Operational

Due to malfunction of FMS, IRS, and EGPWS the unintended route shift, loss of reliable backup navigation, and degraded terrain-avoidance capability are the significant operational overhead. Furthermore, the system instability could increase the manual workload when aircraft enter restricted or controlled zones.

Safety

A spoofed aircraft may unknowingly enter unsafe airspace, terrain, or traffic, creating severe accident potential. The safety issues increase due to occurrence of false alarm, missed real hazards, midair collisions, unsafe proximity to obstacles, and corrupted EGPWS geometric altitude information.

Financial

Flight diversions, delay or cancellations, aircraft damage, increase in insurance premium, cost of investigations, enablement of extended security controls for anti-spoofing defenses, and operational delays are a few of the primary outcomes related to direct financial impacts due to aircraft GPS Spoofing.

Reputational

The reputational impacts are not limited to aircraft companies; they also extend to navigation system providers. Passengers lose confidence in the aircraft service providers, and negative reviews begin to appear, which further generate negative media coverage. The airline’s brand becomes diminished, and trust in GPS-based navigation systems is reduced. Furthermore, regulatory investigations increase security concerns.

Cyber risk awareness/quantification

The following formula could be used to quantify cyber risk.

Cyber Risk = Chance of GPS Spoofing * Danger if Spoofed.

Chance of GPS spoofing

The chance of GPS Spoofing could be determined numerically as 1 (Very unlikely), 2 (Unlikely), 3 (Possible), 4 (Likely), 5 (Very likely) on various factors such as exposure, attractiveness to attackers, and control or protection level. The summary is as follows:

Exposure: The frequency of GPS usage such as never, sometimes or all the time. Users can allocate numbers from 1 to 5 based on usage.

Attractiveness of Attackers: Would an attacker be interested to attack? What negative impact could an attack generate? Users can assign numbers based on anticipated attacker’s interest in executing the attack.

Control or Protection Level: What kind of layered protection available such as additional sensors, trust validation, and network monitoring etc. Based on protection level the number can be assigned.

The following formula can be used to define Spoof scoring.

 S spoof = ( Exposure Score + Attractiveness Score + Protection Score )

Key assets at risk for the case study “cybersecurity case study transportation and supply chain”.
Asset category Examples Why it’s at risk
Navigation systems Aircraft, Ships, Cars, Drones etc. Spoofing changes perceived location
Timing systems Energy grids, telecom networks, Financial systems, Industrial control systems Spoofing modify times, which cause system failures
Operational systems Emergency response services, Logistics, Weather systems Due to misrouting and false alerts negative economic impact occurs

Since each score is a number between 1 to 5. Therefore the chance of spoofing can be evaluated as follows: Chance of Spoofing = S spoof 15

Danger if spoofed

Now to quantify the danger or impact if the GPS Spoof attack occurs, the following variables can be used. L r = Length of the route T s = Sharpness of turns I n = Number of intersections

Finally, the cyber risks can be evaluated as follows: Cyber Risk = S spoof ∗ ( L r + T s + I n )

Best practices/mitigation

The organizations should plan to use multi sensor navigation instead of relying on GPS alone.

Enable Receive autonomous integrity monitoring (RAIM) to detect inconsistencies in satellite geometry and timing.

Robust architecture is needed, which should include a verification step for data received by GPS receivers before it is sent to various sub-systems such as FMS, IRS, and EGPWS.

Incorporate algorithms to detect spoofing by monitoring real time. The algorithms should be capable enough to detect sudden route shifts, identical satellite IDs, abnormal signal strength, and unrealistic satellite geometry.

Spoofed altitude and position frequently conflicts with real terrain data. The terrain database can be used for comparisons of GPS altitude, position, and proximity.

A strong cryptographic authentication can validate GPS Spoofing signals. It is difficult for Spoofers to bypass that.

The pilot training and refine standard operating procedures can help to identify false positives.

Diagrammatic representation of case study

The above Figure 2 depicts the propagation of spoofed GPS signals throughout aircraft systems including FMS, IRS, and EGPWS that would cause erroneous navigation data and consequently endanger the safety of the flights.

Key terms and definitions

The following terms available in Table 3 have been used throughout this case study. Each definition is written in plain language for easy understanding.

GPs spoofing attack architecture in aviation systems- This diagram depicts the propagation of spoofed GPS signals throughout aircraft systems including FMS, IRS, and EGPWS that would cause erroneous navigation data and consequently endanger the safety of the flights. Cybersecurity case study for water department- This diagram depicts the possibility of cyberattacks to affect public health and safety by accessing the SCADA system and manipulating its operations involving chemical dosing process. Key terms used in the case study “cybersecurity case study transportation and supply chain”.
Term Definition
GPS spoofing Sending fake GPS signals to trick a receiver into showing the wrong location, altitude, or time.
GPS jamming Blocking real GPS signals so the receiver cannot get any location information.
ADS-B (Automatic dependent surveillance–broadcast) A system that broadcasts an aircraft’s position, speed, and altitude to air-traffic controllers and nearby aircraft.
Flight management system (FMS) The computer that calculates the aircraft’s route and helps pilots navigate.
Inertial reference system (IRS) A navigation system that uses motion sensors to estimate the aircraft’s position without GPS.
Enhanced ground proximity warning system (EGPWS) A safety system that warns pilots if the aircraft is too close to the ground or obstacles.
Terrain database A digital map of mountains, hills, and ground elevation used for safety warnings.
Signal manipulation attack An attack where false signals are sent to mislead a system.
Cyber-Physical attack A cyberattack that affects real-world physical systems like aircraft, cars, or power grids.
Attack vector The method or path an attacker uses to break into a system.
Threat actor A person or group responsible for carrying out a cyberattack.
Silent failure When a system fails without showing any warning signs.
Cybersecurity case study: Water department

Scenario overview

On February 5, 2021, a plant operator in the Bruce T. Haddock Water Treatment Plant, a small city of approximately 15,000 people outside of Tampa in Florida, made an alarming discovery. He was sitting at his computer when he saw the cursor on his computer start moving itself. There was somebody seemingly operating his computer remotely ( CISA, 2021a).

The plant utilized a remote-access software application known as TeamViewer, which enables the authorized personnel to log in to work from home. The same software has, however, formed a possible access point to any person with the appropriate credentials. As the operator observed, the unknown individual navigated to the sodium hydroxide controls, or lye, as it is generally referred to, which is a small portion of the chemical that is used to treat drinking water and control the acidity. The hacker tried to change the level of a safe 100 parts per million to 11,100 parts per million, 111 times the standard level (CISA, 2021). At such concentrations, the water would lead to serious chemical burns to anyone who drank it.

The operator responded in time, restoring the controls to safe settings and notifying supervisors. None of the polluted water ever got to people. Officials of the city confirmed that even though the change was not noticed, the built-in safety alarms and the 24-36 hour delay in the distribution of water would have given additional time to notice the issue ( Cervini et al., 2022).

Key assets at risk

SCADA system managing water treatment chemical dosing.

Remote desktop access applications (TeamViewer) utilized by operators of the plants.

Sodium hydroxide and other chemical treatment controls

Windows 7 operating system computers that are outdated (not getting security updates).

Network shared between multiple plant workstations

Public drinking water supply for 15,000 residents

Threat event

The Pinellas County Sheriff’s Office states that the SCADA (Supervisory Control and Data Acquisition) system of the plant was accessed by an unauthorized individual remotely twice on February 5th, at about 8:00 AM and 1:30 PM ( Cervini et al., 2022).

During the second intrusion, the operator watched as the attacker opened software controls and switched the sodium hydroxide set point from 100 to 11,100 ppm and disconnected it before leaving. Within seconds, the operator reverted the change. The Secret Service, FBI, and local police started investigations. CISA used a public warning to state that the computers in the plant were operating Windows 7 - an operating system that Microsoft had officially stopped supporting in January 2020, which means it was no longer being patched or updated. The company was also experiencing poor passwording practices, where passwords could be shared among the workers ( CISA, 2021a).

Notably, a subsequent investigation raised questions on whether the event was indeed an external cyberattack or perhaps it was an accident on the part of a worker who altered a value and reported it as a breach. As of 2023, the FBI has not officially confirmed an external attack, and the former manager of the city confirmed privately that investigators had no evidence to suggest that there was external access ( Vasquez, 2023). This renders Oldsmar a useful case study in both senses: it demonstrates the actual cybersecurity vulnerabilities of the water systems, and it demonstrates that the reporting and investigation of the incident can be complicated ( Tuptuk et al., 2021).

Impact analysis

Operational

The water treatment activities were put on hold to investigate them. The authorities of the city made urgent decisions to disconnect remote access tools and check all system logs. The breach initiated cybersecurity assessments in Florida and other water utilities ( CISA, 2021a).

Financial

The Oldsmar plant itself did not suffer direct significant financial losses as the change was promptly noticed. Nevertheless, the move triggered the implementation of expensive national security infrastructure improvements in hundreds of water utilities in the U.S. CISA estimated that water delivered to more than 80 percent of Americans is provided by about 153,000 publicly-owned water systems, most of which were observed to have similar vulnerabilities (EPA, 2023).

Safety

Had the sodium hydroxide not been detected early, it would have resulted in serious chemical burns on the throats, skin, and digestive system of residents. The most vulnerable groups, like children, the aged, and those whose immunity is weakened, would have been exposed to the highest risk of the health problem. Even at lower concentrations, lye can cause severe damage ( Cervini et al., 2022).

Reputational

The incident resulted in national publicity and congressional interest. It served as a wake-up call that small-town water utilities, which are usually under-resourced and understaffed, could become targets of cyberattacks. Several states issued cybersecurity advisories for water suppliers after the incident ( You, 2022).

Cyber risk awareness/quantification:

The following Table 4 provide a brief description about evaluation overall risk.

Simple cost example

Imagine a confirmed water contamination event required emergency bottled water distribution to 15,000 residents for 3 days, plus medical response and cleanup. The estimated emergency response cost would be over the roof. This usually does not include long-term health costs, lawsuits, or federal fines for regulatory violations.

Best practices/mitigation

Discontinue or deactivate remote access software (such as TeamViewer) unless it is necessary (CISA, 2021).

Upgrade outdated operating systems: Windows 7 had not been updated on its security within more than one year before the incident ( CISA, 2021a).

Use a different password that is strong and unique to every employee - do not share passwords among employees (NIST, 2018).

Any remote login to plant control systems should be done using multi-factor authentication (MFA).

Set hard limits on the level of chemicals to ensure that no remote command can exceed the safe limits of the levels, which is a basic engineering safeguard ( Cervini et al., 2022).

Educate all employees in the plants to identify and report suspicious computer activity to the management ( You, 2022).

Regularly perform cybersecurity assessments with support from CISA’s free Water Sector resources (EPA, 2023).

Diagrammatic representation of case study

The above Figure 3depicts the possibility of cyberattacks to affect public health and safety by accessing the SCADA system and manipulating its operations involving chemical dosing process.

Key terms and definitions

The following Table 5 reflects the key terms, which have been used throughout this case study. Each definition is written in plain language for easy understanding.

Overall risk evaluation for the case study “cybersecurity case study for water department”.
Factor Rating Explanation
Likelihood Medium-high Water systems are normally underfunded and are exposed to outdated technology, which makes them much easier to attack.
Impact Critical Thousands of individuals, particularly children and elderly people, can be affected by contaminated water.
Overall risk Critical The risk of mass public harm makes water systems among the highest-priority targets to secure.
Key terms used in the case study “cybersecurity case study for water department”.
Term Definition
SCADA system Supervisory Control and Data Acquisition (SCADA): A mechanism or computer system that is used to observe and manage machines or processes remotely or centrally.
Remote desktop access Software that allows one to remotely operate and control a computer from a different location.
credential A username and a password to gain access to a system.
Dormant account A user account that is no longer actively used but has not been deleted or disabled and is still accessible.
Sodium hydroxide (Lye) A substance used in small amounts to treat water, and is also hazardous at high concentrations.
Chemical dosing System An automated machine that measures and injects the correct amounts of treatment chemicals (like chlorine, fluoride, and lye) into water at a treatment plant.
Insider threat A security threat originating with an individual, with or without authorized access to a system, including an employee, contractor/business partner, or former employee. The threat actor involved in this case study was an ex-contractor, whose credentials were not revoked, and it is an insider threat scenario.
Forensic investigation A detailed technical examination to determine the post-cyberattack outcome.
Operational technology (OT) Hardware and software that monitor or control physical devices, processes, and events within water, energy, and manufacturing industries. In contrast to traditional IT (which manipulates information and communications), OT is actually used to operate physical devices directly. OT needs to be secured since physical damage can be caused by an attack.
Cybersecurity case study: AI data center

Scenario overview

The case study focuses on the 2019 Capital one cyberattack, which is one of the most massive data breaches of cloud-based analytics infrastructure. To store and process high amounts of customer information, the company relied on a modern architecture of a data center hosted on Amazon Web Services. These systems facilitated the processes of automated decision-making, analytics, and machine learning. Nevertheless, due to improperly set up web application firewalls, there was a vulnerability through which an attacker accessed sensitive information. This event showed that AI-based and cloud-based data centers are vulnerable to configuration mistakes and lack of monitoring ( U.S. Department of Justice, 2019).

Key assets at risk

The attack revealed several assets vital to the AI and analytics functions:

Personal information of customers (address, credit scores, names).

Buckets in cloud storage of structured datasets.

Training datasets of machine learning.

Credential identities and authentication keys.

Monitoring and logging systems within the company

Analytics data processing pipelines.

Such assets are critical in the decision-making process using AI, and their security is a necessity.

Threat event

The attacker took advantage of the improper firewall configuration in the cloud infrastructure. Due to this, the attacker was able to carry out a Server-Side Request Forgery (SSRF) attack and obtain credentials. After obtaining the credentials, the attacker was able to access the storage containers and obtain the information stored in them. The breach led to the compromise of 100 million citizens in the United States and 6 million citizens in Canada. The attacker was also able to obtain the internal logs, hence allowing them to maintain unauthorized access ( FBI, 2019).

Impact analysis

Operational: The systems were to be restricted as a means to estimate the level of damage.

Financial: To resolve the problem, Capital One was forced to pay an 80 million dollar fine to regulators. Other expenses incurred by the company were associated with taking measures to deal with the problem ( Office of the Comptroller of the Currency, 2020).

Security: Customer data was compromised because the systems were infiltrated, which resulted in credit card application information disclosure.

Reputation: The hack was covered by the media, which affected the organization.

Legal impact: There were various lawsuits and compliance reviews carries out.

Cyber risk awareness/quantification

Plausibility: Medium.

Aftermath: High.

Cumulative-risk: High.

Simple quantification example:

1. System downtime cost

Downtime duration: 48 hours

Estimated business loss per hour: $150,000

48 × 150,000 = 7,200,000

Downtime Cost = $7.2 million

2. System recovery & reconfiguration cost

IT engineers: 30 engineers

Cost per hour: $100/hour

Duration: 120 hours (approx. 2 weeks work)

30 × 100 × 120 = 360,000

Recovery Cost = $360,000

3. Security tools & infrastructure upgrade

Firewall upgrades

Monitoring tools

Cloud security improvements

Estimated: $8 million.

4. Continuous monitoring cost (post-breach)

Security monitoring team: 10 members

Monthly cost per person: $8,000

Duration: 6 months

10 × 8,000 × 6 = 480,000

Monitoring Cost = $480,000

Total system impact cost

7.2 M + 0.36 M + 8 M + 0.48 M = 16.04 M

Total ≈ $16 million (System-related direct cost)

The actual figure might be even higher due to the presence of various hidden costs such as:

Legal costs and class-action suits

Regulatory fines and penalties

Incident response and forensic analysis

Employee overtime and business disruption

Loss of customer trust and brand damage ( IBM Security, 2023).

Best practices/mitigation

The various steps that can be taken to prevent such breaches include:

Implementing zero-trust security

Implementing multi-factor authentication for cloud account access

Monitoring cloud configurations

Implementing least privilege access

Encrypting sensitive AI and analytics data

Conducting regular vulnerability tests

Implementing real-time threat detection

Diagrammatic representation of case study

The above Figure 4 depicts the consequences of misconfigured cloud computing infrastructures by exploiting SSRF, causing an unwanted exposure and exfiltration of stored data.

Key terms and definitions

The following Table 6 reflects the key terms, which have been used throughout this case study. Each definition is written in plain language for easy understanding.

Cybersecurity case study AI data center- This diagram depicts the consequences of misconfigured cloud computing infrastructures by exploiting SSRF, causing an unwanted exposure and exfiltration of stored data. Key terms used in the case study “cybersecurity case study ai data center”.
Term Definition
Zero trust architecture (ZTA) A security model that requires verification of every user and device before access is granted (“never trust, always verify”).
Cloud infrastructure Systems where data and applications are stored on remote servers instead of local machines (e.g., AWS).
Web application firewall (WAF) A security tool that monitors and filters web traffic to protect applications from attacks.
Server-Side request forgery (SSRF) An attack where a hacker tricks a server into making unauthorized requests to access sensitive data.
Multi-factor authentication (MFA) A login method that requires multiple verification steps, such as a password and a one-time code.
Least privilege access Giving users only the minimum access needed to perform their tasks.
Machine learning dataset Data used to train AI systems for decision-making or predictions.
Incident response The process of handling and recovering from a cybersecurity attack.
Monitoring and logging Tracking system activity to detect unusual or suspicious behavior.
Cybersecurity case study: energy infrastructure

Scenario overview

On May 7, 2021, Colonial Pipeline, the largest refined fuel pipeline in the United States, was hit with a ransomware attack that made national headlines. The pipeline stretches 5,500 miles long, running between Houston, Texas, and New York City, with gasoline, diesel, and jet fuel flowing through it that serve approximately 45% of the fuel demand on the East Coast ( CISA, 2021b).

Colonial Pipeline was hacked into its computer systems by a hacker group Darkside using a single stolen employee password of a VPN account that has not been disabled. Their account was not subjected to multi-factor authentication (additional security measures such as a text message code), and this is why the attackers found it easy to access the account ( Mittal, 2024).

The hackers stole 100 gigabytes of company data within hours and then put a ransomware (software that scrambles computer files and then requires a payment to unlock them) lock on the billing systems of Colonial Pipeline. The company closed down the fuel delivery operations because they feared that the attackers might cause further havoc by destroying the physical pipeline controls. The closure took six days and caused fuel shortages, panic purchases, and gas station queues throughout the southeastern United States ( DOE, 2021). On May 9, 2021, President Biden issued a state of emergency.

Key Assets at risk

Computer system for billing and accounting.

Remote access accounts on VPN (Virtual Private Network)

Industrial control systems managing 5,500 miles of pipeline

Scheduling and operations software for fuel delivery.

Employee and company data are stored on corporate servers

Customer communications and systems of payment.

Threat event

The attack began with one compromised password. The password was later discovered by security investigators in a store of stolen credentials sold on the dark web (the hidden part of the internet where stolen data is bought and sold). The password was for a VPN account that was not actively used but not deactivated ( Beerman et al., 2023).

Darkside attackers remotely accessed the network of Colonial Pipeline using the password. They had no further barrier since no multi-factor authentication was implemented on the account. While inside, they took their time to move through the network, designating systems and determining the most important files using a method referred to as lateral movement. They stole approximately 100 gigabytes of data within a span of two hours. Then they installed ransomware, encrypted billing systems, and demanded 75 bitcoin (which was at that time valued at about 4.4 million dollars) as a ransom ( CISA, 2021b).

The leadership of Colonial Pipeline was uncertain of the level of intrusion that had occurred and therefore decided to close down the entire pipeline as a precautionary measure. The ransom was paid on the same day by the company. The FBI provided a decryption tool, but it was too slow to be of any use, and the company was forced to restore its systems using backups. On May 12, 2021, a few days after the attack, the pipeline operations returned to normal ( DOE, 2021). The U.S. Department of Justice subsequently reclaimed some 63.7 Bitcoin (about $2.3 million) of the ransom.

Impact analysis

Operational

The six-day shutdown of the pipeline impacted gas supply in 17 states and Washington, D.C. Gas stations were forced to run out of fuel, airlines were concerned with the supply, and the Federal Motor Carrier Safety Administration declared emergency measures to compensate by allowing fuel trucks to work extra hours ( DOE, 2021).

Financial

Colonial Pipeline had to pay a ransom of $4.4 million. The company also received nearly 1 million proposed fines by the Department of Transportation due to safety breaches that are related to the incident. Millions were added with recovery expenses, legal fees, and cybersecurity upgrades. According to Mittal (2024), the breaches in the energy sector are the costliest, with the average price of a breach being more than 4.7 million.

Safety

There was a disruption of fuel supply in hospitals, emergency services, and airports on the East Coast. Panic buying also caused unsafe behaviors, including storing fuel in unsafe containers by the people. The incident showed that a cyberattack on the energy infrastructure can pose real physical risks to citizens ( CISA, 2021b).

Reputational

Colonial Pipeline experienced heavy scrutiny by the public and Congress. Senate hearings were carried out to analyze how one leaked password could shut down the biggest fuel pipeline in the country. The incident was one of the most cited cases of cybersecurity failure to protect critical infrastructure in the history of the US ( Tsvetanov & Slaria, 2021).

Cyber risk awareness/quantification

The following Table 7 provide a brief description about evaluation overall risk.

Simple cost example.

Colonial Pipeline had to pay a ransom of $4.4 million. The pipeline supply is more than 100 million gallons of fuel per day. A conservative estimate of the lost economic activity during the 6-day shutdown:

100 million × 6 = 600 million gallons of fuel were disrupted .

overall risk evaluation for the case study “cybersecurity Case Study Energy Infrastructure”.
Factor Rating Explanation
Likelihood High Energy companies are often targeted since the attackers are aware that outages impact millions of people.
Impact Critical Shutting down fuel supply to half the East Coast is a life, safety, and economic impact ( Goodell & Corbet, 2023).
Overall Risk Critical This type of attack is possible to have recurrence, and in this case, they did so with just a single stolen password.

Total impact = $4.4 million +600 million gallons of fuel disruption + additional recovery and economic costs.

Best practices/mitigation

Always deactivate unused accounts immediately ( CISA, 2021b).

Multi-factor authentication (MFA) should be used on any remote access - a single additional step would have prevented this whole attack (NIST, 2018).

Separate IT networks (billing, email) from OT networks (pipeline controls) to restrict damage in case attackers gain access ( CISA, 2021b).

Encourage employees to reset their passwords frequently.

Conduct frequent incident response exercises to ensure that employees are aware of the precise steps to take in case an attack is experienced ( DOE, 2021).

Adhere to the NIST Cybersecurity Framework, a free governmental tool for securing critical systems (NIST, 2018).

Diagrammatic representation of case study

The above Figure 5 depicts how compromised credentials would lead to access and lateral movements in a system and ransomware implementation that can cause disturbance in the functioning of critical energy infrastructures.

Key terms and definitions

The following Table 8 reflects the key terms, which have been used throughout this case study. Each definition is written in plain language for easy understanding.

Cybersecurity case study energy infrastructure- This diagram depicts how compromised credentials would lead to access and lateral movements in a system and ransomware implementation that can cause disturbance in the functioning of critical energy infrastructures. Key terms used in the case study “cybersecurity case study energy infrastructure”.
Term Definition
Ransomware Malicious software that encrypts files and requires a ransom to decrypt them.
VPN (virtual private network) An encrypted and secure means by which employees can access the computer network of a company, even though they are not within the company.
Multi-factor authentication (MFA) A security system in which more than one step is required to log in to gain access.
Lateral movement A technique that allows attackers, once inside a network, to quietly move from one computer or system to another to explore and gather information.
Dark web A hidden part of the internet that cannot be accessed through normal browsers, and where crime is frequently committed.
Encryption Coding (Scrambling) information so that it is only decipherable by the authorized user.
Decryption The process of unscrambling encrypted data back to its original, readable form using a special key.
Industrial control system (ICS) Computer systems that monitor and control physical equipment. They are machines and physical processes controller systems.
Critical infrastructure Systems and assets are so essential to a country’s safety, economy, and public health that their disruption would have a severe national impact.
Bitcoin A digital currency, which is solely virtual and can be sent between users without passing through a bank.
Cybersecurity case study: banking and financial security

Scenario overview

Flagstar Bank is a large U.S. financial institution headquartered in New York, boasting total assets of more than $31 billion and annual revenue of more than $ 1.9 billion. It belongs to the New York Community Bank and offers its customers such services as retail banking, mortgages, and commercial lending that are offered in the United States ( Mascellino, 2023).

Like most modern banks, Flagstar uses external technology vendors, also known as third-party vendors, to support certain areas of its business. One of such vendors is Fiserv, a large payment processing and mobile banking technology company. Fiserv, in turn, used the MOVEit Transfer file transfer program to move large volumes of sensitive financial information across organizations ( Ghanbari et al., 2024).

In May 2023, a ransomware gang known as Clop discovered and exploited a previously unknown security vulnerability, or zero-day, in the MOVEit software. By the time the bug was publicly disclosed and fixed, Clop had gained unauthorized access to the data of thousands of organizations worldwide, including Fiserv’s. Consequently, personal data of 837,390 customers of Flagstar Bank were stolen - names and Social Security numbers ( Mascellino, 2023).

Key assets at risk

Personal identifying information (PII) and Customer Social Security numbers.

Third-party file transfer systems (MOVEit) are used to process banking data

Mobile banking and payment processing platforms managed by vendor Fiserv

Customer account records and transaction data

The bank’s reputation and compliance standing with regulators

Trust relationships between the bank and its third-party service providers

Threat event

The attack did not originate at Flagstar Bank itself, but at one of its technology vendors. The ransomware group Clop used a zero-day vulnerability in MOVEit Transfer software between May 27 and 31, 2023. A zero-day vulnerability is a security flaw that is unknown to the software developer and the community at large, meaning there is no patch or fix yet. This provides attackers with a significant advantage ( Ghanbari et al., 2024).

Clop exploited the weakness to silently gain access to the information being transferred using the Fiserv MOVEit systems, including files belonging to Flagstar Bank clients. Fiserv was unable to detect or prevent the attack in time because it occurred before the flaw was publicly known. On May 31, 2023, the vulnerability was publicly disclosed by Progress Software (the creator of MOVEit), more than two months after the breach itself happened, making Fiserv aware of it on the same day, at which point Flagstar Bank was notified about it (approximately August 8, 2023). On October 6, 2023, Flagstar Bank began notifying affected customers through notification letters ( Mascellino, 2023).

By October 2023, it had compromised more than 2,500 organizations worldwide, including banks, government bodies, universities, and corporations, exposing the personal data of more than 64 million people ( Mascellino, 2023). Clop took ownership of the attack and posted the names of victim organizations on its own site as a way of pressurizing them to pay the ransom to prevent further data exposure.

Impact analysis

Operational

Flagstar Bank had to investigate the breach, track down all affected customers, report to regulators, and implement identity monitoring for more than 837,000 customers. It was achieved over several months and required significant resources and staff beyond regular banking operations ( Mascellino, 2023).

Financial

All customers who were impacted by this began receiving free identity monitoring services from Kroll for 2 years, organized by Flagstar Bank. The direct expenses included legal charges, regulatory notification expenses, credit surveillance, and exposure to a class-action lawsuit. According to Lee et al. (2022), financial sector data breaches cost an average of $5.9 million per incident, one of the highest among industries. Research on U.S. commercial banks indicates that breached institutions record considerably lower returns on equity and assets in the quarters following an attack ( Erkan-Barlow et al., 2023).

Safety

If a Social Security number is stolen, the thief can commit identity theft by creating a counterfeit credit card, filing a false tax return, and taking out loans in the victim’s name. This may cost people years of money. Victims who do not monitor their credit carefully may not realize they are victims of identity theft until serious harm has already occurred ( Kamiya et al., 2021).

Reputational

It is the third large data breach at Flagstar Bank in three years (2021, 2022, and 2023), which has been devastating to customer trust ( Kamiya et al., 2021). The bank’s security experts and vendors publicly criticized the lack of proper supply chain risk management. The case illustrated how a bank may fall victim to a significant breach even when its own systems are not directly attacked through a trusted vendor’s vulnerability.

Cyber risk awareness/quantification

The following Table 9 provide a brief description about evaluation overall risk.

Simple cost example

837,390 customers each received 2 years of identity monitoring at approximately $20/month per person:

837,390 × $ 20 / month × 24 months = ~ $ 402 million in monitoring costs alone

Overall risk evaluation for the case study “cybersecurity case study banking and financial security”.
Factor Rating Explanation
Likelihood High Banks are the most targeted industry because attackers can steal money or personal data used for identity theft.
Impact High Over 837,000 individuals were victims of having their Social Security numbers stolen, a form of damage that can have a long-term effect.
Overall risk High Even secure banks can be compromised through their vendors, a risk that is difficult to see and control ( Liu & Babar, 2026).

This figure does not include legal fees, regulatory fines, staff time, or reputational losses.

Best practices/mitigation

Carry out thorough cybersecurity assessments on all third-party vendors before sharing sensitive customer data with them ( Cremer et al., 2022).

Require vendors to notify the bank immediately, not months later, if a breach or vulnerability is discovered.

Encrypt all transfers of data to ensure that if files are accessed, they cannot be read without a key (NIST, 2018).

Apply zero-trust principles: Authenticate all users and all systems, including trusted vendor networks ( Ghanbari et al., 2024).

Develop a vendor risk management program that rates and continuously monitors the security posture of every technology partner.

Diagrammatic representation of case study

The above Figure 6 shows the possible attack on financial information through vulnerability in third-party software applications used for other purposes.

Key terms and definitions

The following Table 10 reflects the key terms, which have been used throughout this case study. Each definition is written in plain language for easy understanding.

Cybersecurity Case Study Banking and Financial Security- This diagram shows the possible attack on financial information through vulnerability in third-party software applications used for other purposes. Key terms used in the case study “cybersecurity case study banking and financial security”.
Term Definition
Zero-day vulnerability A vulnerability in software that the software developer and the public are unaware of, meaning there is no patch (fix) available. Since one knows about it, defenders have no protection against it.
SQL injection A cyberattack where the attacker executes malicious code in a website query or database query to trick the system into issuing unauthorized access to its data.
Supply chain attack An attack whereby a company does not attack directly, but via a trusted third-party vendor or software supplier that the company uses.
Third-party vendor A company that is outside and is contracted by a business to offer service or technology.
Personally identifiable information (PII) Any data that can be used to identify a particular person - a name, address, date of birth, Social Security number, etc.
Patch A computer software update that a developer publishes to correct a security vulnerability or bug.
Data exfiltration The unauthorized transfer of data from a computer or network by an attacker to a third-party location.
Ransomware-as-a-service (RaaS) A type of criminal business where a ransomware organization (such as Clop) creates and sells its hacking infrastructure to other criminals to execute their own attacks and share the profits.
Identity theft When an individual steals the personal information of another person and uses it to commit a fraud, such as a credit card, a loan, or a forged tax filing in the name of another person.
Cybersecurity Case Study: Ransomware attack on jaguar land rover

Scenario overview

Jaguar Land Rover (JLR) is a British multinational automotive manufacturer and a subsidiary of India’s Tata Motors. The company produces luxury and off-road vehicles under the Jaguar and Land Rover brands, operating major manufacturing plants in Solihull, Halewood, and Wolverhampton in the United Kingdom. JLR is one of the UK’s largest manufacturers, supporting an extensive supply chain of over 5,000 organizations and more than 104,000 supply chain jobs across the country ( Burgess, 2025).

The manufacturing sector is one of the most targeted industries for cyberattacks worldwide. According to the Arctic Wolf 2026 Threat and Predictions Report, from 2024 to 2025, the number of victimized manufacturers nearly doubled, making manufacturing the sector with the highest victim count globally. IBM’s X-Force 2025 Threat Intelligence Index also lists manufacturing as the top-targeted industry, a position it has held for four consecutive years. The median cost of a manufacturing ransomware attack is now $600,000 USD ( Arctic Wolf, 2026).

On August 31, 2025, a cybercriminal collective known as Scattered Lapsus Hunters launched a devastating ransomware attack on JLR’s IT systems. The attack forced the automaker to shut down all production across its UK plants for over five weeks, making it the most damaging cyberattack in British history, with an estimated total cost to the UK economy of £1.9 billion ( BBC News, 2025b).

Key assets at risk

Production line control systems and operational technology (OT) across three major UK manufacturing plants

Enterprise IT infrastructure, including SAP systems, internal communications, and automated ordering platforms

Proprietary vehicle designs, engineering blueprints, and manufacturing process intellectual property

Employee personal data, payroll records, and human resources information

Global supply chain coordination systems linking over 5,000 supplier organizations

Brand reputation and consumer trust in Jaguar and Land Rover as premium automotive brands

Threat event

The attack began on August 31, 2025, when threat actors exploited a zero-day vulnerability in a third-party remote-access tool to gain an initial foothold in JLR’s critical systems. Once inside the network, the attackers moved laterally across the infrastructure before deploying ransomware on the company’s systems, including its SAP enterprise resource planning platform. JLR paused production on September 1, 2025, and by September 22, all production lines at the Solihull, Halewood, and Wolverhampton plants had ceased operations entirely, with staff instructed to stay at home ( Vallance & Leggett, 2025).

A group calling itself Scattered Lapsus$ Hunters claimed responsibility for the attack on Telegram, suggesting a collaboration between three English-speaking cybercrime groups: Scattered Spider, Lapsus$, and ShinyHunters. Members of the group shared screenshots reportedly taken from inside JLR’s IT networks, including images of internal SAP systems, and claimed to have deployed ransomware and exfiltrated sensitive data ( Gatlan, 2025). The same collective was linked to a wave of cyberattacks on major UK retailers, including Marks & Spencer, earlier in 2025 ( Milmo, 2025).

Initially, JLR planned to restart production on September 24, but announced on September 23 that the shutdown would continue until October 1. Production finally began restarting on October 8, 2025, following a gradual, controlled approach, but the company did not return to normal production levels until mid-November 2025. A forensic investigation was launched, and a criminal investigation was opened by law enforcement ( Young, 2025).

Impact analysis

Operational

The ransomware attack forced a complete production shutdown across all three of JLR’s major UK manufacturing plants for over five weeks. Assembly lines stood idle, employees were sent home, and workarounds were introduced to partially restore some functions, but significant disruption continued for months. Internal systems, including automated production lines, ordering platforms, and communication tools, were taken offline to contain the breach. September 2025 car production in the UK fell to its lowest level since 1952 as a direct result of the shutdown ( Burgess, 2025).

Financial

In its financial results published in November 2025, JLR revealed that the attack cost £196 million in direct costs during the second quarter of its fiscal year. The company posted a pre-tax loss of £485 million for the July–September 2025 quarter, compared with a profit of £398 million for the same period the previous year. The cyberattack was estimated to cost JLR over £50 million per week of downtime. The broader impact on the UK economy was estimated at £1.9 billion, accounting for supply chain disruptions, lost output, and reduced exports ( Pearson, 2025).

Supply chain

The shutdown devastated JLR’s supply chain. According to the Cyber Monitoring Centre, over 5,000 UK organizations were impacted, including first-, second-, and third-tier automotive parts suppliers, logistics companies, service providers, and dealerships. One smaller JLR supplier confirmed that it had laid off 40 people, nearly half of its workforce. The trade union Unite reported that supply chain staff were advised to apply for Universal Credit, the UK’s social welfare benefit. MP Liam Byrne described the situation as a “digital siege” and warned that thousands of jobs were at risk across the supply chain.

Reputational and national impact

The JLR cyberattack attracted national and international media coverage and became a matter of parliamentary debate. The Bank of England cited the attack as one of the key factors contributing to lower-than-expected UK GDP growth in the third quarter of 2025, noting that the production stoppage directly contributed to a 0.17 percentage point contraction in GDP in September ( Jones, 2025). The UK government intervened with a £1.5 billion loan guarantee to stabilize the automotive supply chain. The Department for Business and Trade and the Society of Motor Manufacturers and Traders issued a joint statement acknowledging the significant impact on JLR and the broader manufacturing sector ( UK Government, 2025). Jamie MacColl of the Royal United Services Institute described the incident as “unprecedented in the UK” in terms of the level of disruption caused by a cyberattack ( Burgess, 2025).

Cyber risk awareness/quantification

The following Table 11 provide a brief description about evaluation overall risk.

Simple cost example

JLR’s estimated weekly cost of the production shutdown was £50 million. With a shutdown lasting approximately 5 weeks: £50,000,000 × 5 weeks = £250 million in lost production revenue.

This figure accounts only for direct production losses. The total direct cost reported by JLR was £196 million for the quarter, while the broader economic impact, including supply chain losses, reduced exports, and government intervention costs, was estimated at £1.9 billion ($2.5 billion USD) ( Pearson, 2025).

Best practices/mitigation

Implement zero-trust architecture to verify all users, devices, and systems before granting access, particularly for remote-access tools and third-party integrations that served as the initial attack vector in the JLR breach (NIST, 2018).

Segment IT and OT networks to prevent lateral movement from corporate systems to production control systems, ensuring that a breach in one domain does not cascade to manufacturing operations ( Arctic Wolf, 2026).

Conduct regular vulnerability assessments and patch management for all third-party remote-access tools and software, prioritizing zero-day vulnerability monitoring.

Develop and regularly test a multi-site incident response plan that includes procedures for coordinating with suppliers, government agencies, and law enforcement during extended production shutdowns ( UK Government, 2025).

Maintain offline, immutable backups of critical production data, SAP configurations, and enterprise systems to enable rapid recovery without reliance on ransomware decryption (NIST, 2018) [54].

Establish supply chain cybersecurity requirements and communication protocols so that dependent organizations receive timely notification and can activate their own contingency plans during an incident ( Burgess, 2025).

Diagrammatic representation of case study

The above Figure 7 demonstrates the way ransomware propagates between the IT systems and OT systems, causing disruption of manufacturing operations through the supply chain.

Key terms and definitions

The following Table 12 reflects the key terms, which have been used throughout this case study. Each definition is written in plain language for easy understanding.

Overall risk evaluation for the case study “cybersecurity case study ransomware attack on Jaguar Land Rover”.
Factor Rating Explanation
Likelihood High Manufacturing has been the most targeted industry for cyberattacks for four consecutive years. The raw count of victimized manufacturers nearly doubled between 2024 and 2025 ( Arctic Wolf, 2026).
Impact Critical Five weeks of total production shutdown, £196 million in direct costs, £1.9 billion in economic damage to the UK, over 5,000 organizations impacted in the supply chain, and GDP contraction cited by the Bank of England.
Overall risk Critical Large manufacturers with interconnected IT/OT systems and extensive supply chains face cascading risks where a single breach can paralyze thousands of dependent organizations and impact national economies ( Burgess, 2025).
Cybersecurity case study ransomware attack on Jaguar Land Rover- The figure demonstrates the way ransomware propagates between the IT systems and OT systems, causing disruption of manufacturing operations through the supply chain. Key terms used in the case study “cybersecurity case study ransomware attack on jaguar land rover”.
Term Definition
Ransomware A type of malicious software that encrypts a victim’s files or systems and demands a payment (ransom) to restore access. If the ransom is not paid, the attacker may the data or publish it online.
Zero-day vulnerability A security flaw in software that the software developer and the public are unaware of, meaning there is no patch (fix) available. Since no one knows about it, defenders have no protection against it.
Lateral movement A security flaw in software that the software developer and the public are unaware of, meaning there is no patch (fix) available. Since no one knows about it, defenders have no protection against it.
Supply chain attack A cyberattack in which a company is not targeted directly, but through a trusted third-party vendor, software supplier, or service provider that the company depends on.
Operational technology (OT) Hardware and software systems that monitor and control physical processes, such as robotic assembly lines, production equipment, and industrial control systems in a factory.
Zero-trust architecture A cybersecurity approach that assumes no user, device, or system should be trusted by default, even if they are inside the organization’s network. Every access request must be verified before being granted.
Network segmentation The practice of dividing a computer network into smaller, isolated sections so that if an attacker gains access to one section, they cannot easily move to other parts of the network.
Personally identifiable information (PII) Any data that can be used to identify a specific person, such as a name, address, date of birth, Social Security number, or email address.
Intellectual property (IP) Creations of the mind that have commercial value and are legally protected, such as vehicle designs, engineering blueprints, proprietary manufacturing processes, and trade secrets.
Agriculture Cybersecurity Case study: Ransomware attack on duvel moortgat brewery

Scenario overview

Duvel Moortgat is a major Belgian brewery founded in 1871, headquartered in Puurs-Sint-Amands, Belgium. The company is known for producing iconic beer brands including Duvel, Maredsous, and La Chouffe. Duvel Moortgat operates four brewing facilities in Belgium and one in Kansas City, Missouri, in the United States through its subsidiary Boulevard Brewing Company. The brewery relies on interconnected IT systems for production management, inventory tracking, supply chain coordination, and enterprise resource planning across all its international sites ( Greig, 2024) [63].

The food and agriculture sector, which includes beverage production, is classified as one of 16 critical infrastructure sectors by the U.S. Department of Homeland Security. This sector is increasingly targeted by cybercriminals due to its reliance on operational technology (OT) and information technology (IT) systems that are vulnerable to cyberattacks ( CISA, 2024). In 2021, the FBI issued warnings about ransomware groups specifically targeting the food and agriculture sector, noting that disruptions could have cascading effects on food supply chains ( FBI, 2022).

On the night of March 5, 2024, the Stormous ransomware gang launched a ransomware attack on Duvel Moortgat Brewery, causing all production to halt at the company’s Belgian and U.S. facilities. The attackers claimed to have stolen 88 gigabytes of data from the brewery’s systems and demanded a ransom payment by March 25, 2024 ( Gatlan, 2024).

Key assets at risk

Production control systems managing brewing, bottling, and packaging operations across five facilities.

Enterprise IT infrastructure including servers, databases, and internal communication systems

Proprietary brewing data, recipes, and operational trade secrets

Employee and human resources records, including accounting and payroll information

Supply chain management systems coordinating ingredient procurement and distribution logistics

Brand reputation and consumer trust in Duvel Moortgat’s portfolio of premium beer brands

Threat event

At approximately 1:30 AM on March 6, 2024, automated threat detection systems in Duvel Moortgat’s IT department flagged the presence of ransomware on the company’s network. Spokesperson Ellen Aerts confirmed that the IT team immediately initiated incident response procedures, shutting down servers across all sites to contain the spread of the malware. This decision brought production to a standstill at all four Belgian facilities and the Kansas City brewery in the United States ( Gatlan, 2024).

The Stormous ransomware group, a pro-Russian cybercriminal organization, claimed responsibility for the attack. Stormous added Duvel Moortgat to its leak site on March 7, 2024, claiming to have exfiltrated 88 gigabytes of data and setting a ransom deadline of March 25, 2024. According to Cisco Talos research, Stormous had been collaborating with another hacking group called GhostSec since July 2023, jointly conducting double extortion ransomware attacks using the GhostLocker and StormousX ransomware programs against victims across more than 15 countries ( Raghuprasad, 2024). The groups operated a ransomware-as-a-service (RaaS) platform called STMX_GhostLocker, which allowed affiliates to deploy ransomware or sell stolen data through their infrastructure ( Raghuprasad, 2024).

The situation was further complicated when, on March 13, 2024, a second ransomware group called Black Basta also claimed to have stolen more than one terabyte of data from Duvel Moortgat and its U.S. subsidiary Boulevard Brewing, including accounting and human resources information. Duvel Moortgat refused to pay the ransom, and the stolen data was subsequently published on the attackers’ leak sites ( Cyber-Plan, 2024). The Antwerp public prosecutor’s office opened an investigation into the cyberattack.

Impact analysis

Operational

The ransomware attack caused a complete production shutdown across all five of Duvel Moortgat’s brewing and bottling facilities in Belgium and the United States. Production at the main Puurs-Sint-Amands brewery was not restored until March 8, approximately three days after the attack was detected. During this period, no beer was brewed, bottled, or shipped from any facility. The company was forced to rely on existing inventory to fulfill orders. IT teams worked around the clock to restore systems, investigate the breach, and implement additional security measures before resuming operations ( Gatlan, 2024).

Financial

The financial impact included direct costs from lost production revenue during the multi-day shutdown, IT incident response and forensic investigation expenses, system restoration costs, and potential legal liabilities related to the exfiltration of employee data. According to Kulkarni et al. (2025), ransomware attacks on the food and agriculture sector have resulted in ransom demands ranging from tens of thousands to millions of dollars, with the JBS Foods attack in 2021 resulting in an $11 million ransom payment. While Duvel Moortgat refused to pay the ransom, the indirect costs of operational downtime, data breach remediation, and reputational damage are significant.

Safety/Food supply

Although the Duvel Moortgat attack did not directly compromise food safety, it demonstrated how cyberattacks on the food and agriculture sector can disrupt supply chains. The FBI has warned that ransomware attacks on this sector risk causing shortages in food availability, particularly when attacks coincide with critical production periods ( FBI, 2022). In a more extreme case in the same sector, a ransomware attack on a Swiss farm in November 2023 disabled livestock monitoring systems, leading to the death of a calf and the euthanasia of the mother cow, showing that cyberattacks on agriculture can directly endanger animal welfare and food production ( James, 2024).

Reputational

The public disclosure of the attack, combined with the publication of stolen data on dark web leak sites by both Stormous and Black Basta, caused reputational harm to Duvel Moortgat. Extensive media coverage of the attack drew global attention to the brewery’s cybersecurity vulnerabilities. The fact that two separate ransomware groups claimed to have breached the company’s systems raised questions about the adequacy of its cybersecurity posture. For a premium brand built on heritage and trust, such exposure can erode consumer and business partner confidence ( Kulkarni et al., 2025).

Cyber risk awareness/quantification

The following Table 13 provide a brief description about evaluation overall risk.

Simple Cost Example

Assuming Duvel Moortgat’s five facilities generate combined daily revenue of approximately $1.5 million and production was halted for 3 days:

$ 1,500,000 × 3 days = ~ $ 4.5 million in lost production revenue

Overall risk evaluation for the case study “cybersecurity case study ransomware attack on Duvel Moortgat Brewery”.
Factor Rating Explanation
Likelihood High The food and agriculture sector has experienced a significant increase in ransomware attacks, with the FBI documenting ransomware targeting six grain cooperatives during the 2021 harvest season alone ( FBI, 2022).
Impact High Production was halted for three days across all facilities, 88 GB of data was exfiltrated, and a second ransomware group (Black Basta) also claimed to have stolen over 1 TB of data.
Overall risk High Beverage producers and food manufacturers are high-value targets due to their time-sensitive production schedules and the cascading effects of supply chain disruptions ( Kulkarni et al., 2025).

This figure does not include IT forensic investigation costs, system restoration expenses, legal fees, employee data breach notification costs, or long-term reputational losses.

Best practices/mitigation

Deploy endpoint detection and response (EDR) systems across all production and IT environments to detect ransomware activity early, as Duvel’s automated threat detection enabled rapid response ( CISA, 2024).

Implement network segmentation to isolate production OT systems from corporate IT networks, preventing lateral movement of ransomware across facilities.

Maintain regular offline backups of critical production data and enterprise systems to enable rapid recovery without paying ransom demands ( CISA, 2024).

Enforce multi-factor authentication (MFA) on all remote access points, VPNs, and privileged accounts to reduce the risk of unauthorized access ( CISA, 2024).

Develop and regularly test an incident response plan that includes procedures for multi-site shutdowns, communication protocols, and coordination with law enforcement agencies.

Conduct regular cybersecurity awareness training for all employees, focusing on recognizing phishing attempts and social engineering tactics commonly used by ransomware groups ( Kulkarni et al., 2025).

Diagrammatic representation

The above Figure 8 represents the propagation of ransomware among the IT systems and OT systems of food production operations, which cause supply chain disruptions.

Key terms and definitions

The following Table 14 reflects the key terms, which have been used throughout this case study. Each definition is written in plain language for easy understanding.

Cybersecurity case study ransomware attack on Duvel Moortgat Brewer- The figure represents the propagation of ransomware among the IT systems and OT systems of food production operations, which cause supply chain disruptions. Key terms used in the case study “cybersecurity case study ransomware attack on Duvel Moortgat Brewery”.
Term Definition
Ransomware A type of malicious software that encrypts a victim’s files or systems and demands a payment (ransom) to restore access. If the ransom is not paid, the attacker may delete the data or publish it online.
Ransomware-as-a-Service (RaaS) A criminal business model where a ransomware group develops hacking tools and rents or sells them to other criminals (affiliates) who carry out attacks and share the profits with the developers.
Double extortion A ransomware tactic where attackers not only encrypt the victim’s data but also steal a copy of it. They then threaten to publish the stolen data online if the ransom is not paid, putting pressure on the victim from two directions.
Data exfiltration The unauthorized transfer of data from a computer or network by an attacker to an external location under the attacker’s control.
Operational technology (OT) Hardware and software systems that monitor and control physical processes, such as manufacturing equipment, brewing systems, and production lines in a factory or plant.
Information technology (IT) Computer systems, networks, and software used for storing, processing, and communicating data, such as email servers, databases, and enterprise applications.
Critical Infrastructure Essential systems and assets that a country relies on for national security, economic stability, and public health. Examples include energy grids, water systems, healthcare, and food and agriculture.
Endpoint detection and response (EDR) A cybersecurity tool installed on computers and servers that continuously monitors for suspicious activity, detects threats, and helps security teams respond to attacks quickly.
Network segmentation The practice of dividing a computer network into smaller, isolated sections so that if an attacker gains access to one section, they cannot easily move to other parts of the network.
Multi-factor authentication (MFA) A security method that requires users to verify their identity using two or more forms of proof before accessing a system, such as a password plus a code sent to their phone.
Leak Site A website, usually on the dark web, where ransomware groups publish stolen data from victims who refuse to pay the ransom, as a way to pressure them or damage their reputation.
Incident response plan A documented set of procedures that an organization follows when a cybersecurity incident occurs, including steps for detection, containment, recovery, and communication.
Personally identifiable information (PII) Any data that can be used to identify a specific person, such as a name, address, date of birth, Social Security number, or email address.
Phishing A social engineering attack where an attacker sends a fraudulent message, usually by email, designed to trick the recipient into revealing sensitive information or clicking a malicious link.
Cybersecurity case study: Ransomware attack on change healthcare

Scenario Overview

Change Healthcare is a large healthcare technology and Payments Company and a subsidiary of UnitedHealth Group, one of the largest healthcare companies in the world. Change Healthcare operates as the largest medical claims clearinghouse in the United States, processing approximately 15 billion healthcare transactions annually and touching one in every three patient records. The company handles an estimated $2 trillion in annual medical claims, representing approximately 44% of all funds flowing through the U.S. medical system. About 189,000 medical providers rely on its software and services for eligibility verification, prior authorization, claims processing, and payment facilitation ( Fliegelman & Stemp, 2024).

The American Hospital Association (AHA) has described Change Healthcare as the predominant source for “more than 100 critical functions that keep the healthcare system operating” ( AHA, 2024a). Because of this central role, Change Healthcare functions as a single point of failure in the U.S. healthcare system. A court filing made by the Department of Justice quoted Change Healthcare as stating that “the healthcare system, and how payers and providers interact and transact, would not work without Change Healthcare” ( Fliegelman & Stemp, 2024).

On February 21, 2024, the ALPHV/BlackCat ransomware gang launched a devastating ransomware attack on Change Healthcare, encrypting the company’s systems and stealing up to 6 terabytes of sensitive data, including patient Social Security numbers, medical records, and information on active military personnel. The attack disrupted healthcare operations across the entire United States and has been described as “the most significant and consequential incident of its kind against the U.S. healthcare system in history” ( AHA, 2024a).

Key Assets at risk

Protected health information (PHI) of an estimated 190 million individuals, including medical records, diagnoses, and treatment information

Personally identifiable information (PII), including patient Social Security numbers, dates of birth, and addresses

Financial and insurance data, including claims records, payment information, and coverage details

Claims clearinghouse infrastructure processing 15 billion annual healthcare transactions

Eligibility verification, prior authorization, and electronic payment systems used by 189,000 medical providers

The operational continuity of the entire U.S. healthcare payment ecosystem, including hospitals, pharmacies, and physician practices

Threat event

The attack began on February 12, 2024, when the ALPHV/BlackCat ransomware group gained initial access to Change Healthcare’s systems using stolen credentials. According to testimony by UnitedHealth Group CEO Andrew Witty before the U.S. Congress, the attackers used the compromised credentials to remotely access a Change Healthcare Citrix portal that enabled remote desktop access. Critically, this portal did not have multi-factor authentication (MFA) enabled, allowing the attackers to gain access with stolen credentials alone. As Senator Ron Wyden summarized, “This hack could have been stopped with cybersecurity 101” ( Hyperproof, 2026).

After gaining initial access, the attackers moved laterally within Change Healthcare’s network for nine days, exfiltrating approximately 6 terabytes of data before deploying ransomware on February 21, 2024, which encrypted the company’s systems. Change Healthcare detected the attack on February 21, disconnected its networks, and took all operations offline. The ALPHV/BlackCat group claimed responsibility for the attack on February 26 and stated it had stolen patient Social Security numbers, medical records, and information on active military personnel. UnitedHealth Group, through its subsidiary Optum, paid a $22 million ransom in Bitcoin on March 3 to secure the deletion of the stolen data. However, the ransomware group performed an exit scam, and the payment did not secure the data ( Alder, 2026).

The situation worsened in April 2024 when a second ransomware group, RansomHub, claimed to have obtained the stolen data from a former ALPHV affiliate and issued an additional extortion demand, threatening to sell the data to the highest bidder. RansomHub leaked screenshots that appeared to include Change Healthcare patient files. The demand was later removed from RansomHub’s website, though it remains unclear whether a second ransom was paid ( Hyperproof, 2026).

Impact analysis

Operational

The attack caused an immediate and nationwide disruption to the U.S. healthcare system. When Change Healthcare took its systems offline, hospitals could not verify patient insurance eligibility, pharmacies could not process prescriptions, and physicians could not submit claims or receive payments for services rendered. The AHA reported that nearly 94% of hospitals experienced financial repercussions from the attack ( AHA, 2024b). According to Kodiak Solutions, the value of claims submitted dropped by $6.3 billion across its 1,850 hospitals and 250,000 physician clients in just the first three weeks after the attack. UnitedHealth reported that it took months to restore full functionality, with 99% of pharmacy network services restored by March 18, 2024, while other systems took significantly longer ( Hyperproof, 2026).

Financial

The financial impact of the Change Healthcare attack has been staggering. UnitedHealth Group reported $872 million in losses in Q1 2024 alone. By the end of Q3 2024, the total cyberattack cost had risen to $2.457 billion, including $1.521 billion in direct response costs. The total anticipated cost for 2024 was revised to $2.87 billion. UnitedHealth Group advanced more than $9 billion to struggling healthcare providers to mitigate the cash flow crisis caused by the disruption. Large health systems reported losing more than $100 million per day during the outage. An American Medical Association survey revealed that 80% of physician practices lost revenue from unpaid claims (Healthcare IT, 2024).

Safety/patient care

The disruption to claims processing and eligibility verification directly endangered patient care. Patients experienced delays in receiving medications as pharmacies could not verify insurance coverage. Hospitals postponed elective procedures due to uncertainty about reimbursement. The financial strain was particularly severe for smaller practices and rural hospitals, with some facing the risk of closure due to prolonged inability to process claims and receive payments. The AHA warned that the attack endangered patients and threatened the solvency of U.S. healthcare providers across the country ( AHA, 2024a).

Reputational and legal

The breach triggered massive legal and regulatory consequences. The U.S. Department of Health and Human Services Office for Civil Rights (OCR) launched an investigation into potential HIPAA violations. By June 2024, a judicial panel had consolidated over 50 federal lawsuits into a single multidistrict litigation case in Minnesota (MDL No. 3108). Multiple state attorneys general, beginning with Nebraska, filed lawsuits against Change Healthcare. U.S. Senators demanded answers from UnitedHealth Group CEO Andrew Witty, and Senator Mark Warner introduced legislation proposing cybersecurity conditions for Medicare payments during cyberattacks. The revelation that the breach was caused by the absence of basic multi-factor authentication on a critical access portal drew widespread criticism of UnitedHealth Group’s cybersecurity posture ( Hyperproof, 2026).

Cyber risk awareness/quantification

The following Table 15 provide a brief description about evaluation overall risk.

Simple cost example

UnitedHealth Group reported total cyberattack costs of $2.87 billion for 2024, broken down as follows:

$1.521 billion in direct response costs (forensics, system restoration, notifications) + $22 million ransom payment + $9 billion in provider advances + legal fees and regulatory costs = $2.87 billion in total reported costs for 2024

This figure does not account for the broader economic harm to the healthcare system, including the $6.3 billion drop in claims submissions in just the first three weeks, revenue losses suffered by 94% of U.S. hospitals, or the long-term costs of ongoing litigation and regulatory penalties.

Best practices/mitigation

Enforce multi-factor authentication (MFA) on all remote access points, VPNs, and Citrix portals without exception. The absence of MFA on a single Citrix portal was the root cause of the Change Healthcare breach ( Hyperproof, 2026).

Implement network segmentation to prevent lateral movement, ensuring that an attacker who compromises one system cannot move freely across the entire network for days without detection ( Fliegelman & Stemp, 2024).

Deploy advanced endpoint detection and response (EDR) systems with behavioral analysis capabilities to detect data exfiltration and lateral movement before ransomware is deployed. Furthermore, maintain immutable, offline backups of all critical systems and data, tested regularly for recovery readiness, to enable rapid restoration without reliance on ransom payment ( Cybersecurity, 2018).

Develop business continuity plans that account for extended outages of critical third-party service providers, including alternative claims processing and payment pathways ( AHA, 2024a).

Conduct regular third-party risk assessments to identify single points of failure in the healthcare supply chain, and establish redundant systems or alternative providers for critical functions ( Fliegelman & Stemp, 2024).

Use detect, protect, identify, recover, and respond framework to maintain business continuity ( Cybersecurity, 2018).

Diagrammatic representation of case study

The above Figure 9 reflects the diagrammatic representation of how credential compromise leads to data breach and ransomware infection, causing disruptions in the national healthcare systems.

Key terms and definitions

The following Table 16 reflects the key terms, which have been used throughout this case study. Each definition is written in plain language for easy understanding.

Overall risk evaluation for the case study “Cybersecurity case study ransomware attack on change healthcare”.
Factor Rating Explanation
Likelihood High Healthcare has been one of the most targeted sectors for ransomware attacks. Between 2020 and 2024, healthcare data breaches increased year over year, with 2024 seeing breaches affecting over 289 million individuals ( Alder, 2026).
Impact Critical An estimated 190 million individuals had their data compromised, 94% of U.S. hospitals experienced financial repercussions, and total costs exceeded $2.87 billion. The attack disrupted the entire U.S. healthcare payment ecosystem.
Overall Risk Critical Change Healthcare’s role as a single point of failure in the healthcare system means that a single breach can paralyze claims processing, eligibility verification, and payments for the majority of U.S. healthcare providers ( Fliegelman & Stemp, 2024).
Cybersecurity case study ransomware attack on change healthcare- The figure reflects the diagrammatic representation of how credential compromise leads to data breach and ransomware infection, causing disruptions in the national healthcare systems. Key terms used in the case study “cybersecurity case study ransomware attack on change Healthcare”.
Term Definition
Ransomware A type of malicious software that encrypts a victim’s files or systems and demands a payment (ransom) to restore access. If the ransom is not paid, the attacker may delete the data or publish it online.
ALPHV/blackCat A Russian-linked ransomware group that operates a ransomware-as-a-service (RaaS) platform, providing tools to affiliates who carry out attacks. They were responsible for the Change Healthcare breach.
Multi-factor authentication (MFA) A security method that requires users to verify their identity using two or more forms of proof before accessing a system, such as a password plus a code sent to their phone.
Protected health information (PHI) Any health-related information that can be linked to a specific individual, including medical records, diagnoses, treatment histories, and insurance details. PHI is protected under HIPAA regulations.
Personally identifiable information (PII) Any data that can be used to identify a specific person, such as a name, address, date of birth, Social Security number, or email address.
HIPAA (health insurance portability and accountability act) A U.S. federal law that sets standards for protecting sensitive patient health information. Organizations that handle PHI must implement security safeguards and report data breaches.
Data exfiltration The unauthorized transfer of data from a computer or network by an attacker to an external location under the attacker’s control.
Single point of failure A component in a system that, if it fails, will cause the entire system to stop working. In this case, Change Healthcare was a single point of failure for U.S. healthcare payments.
Exit scam A fraudulent scheme in which a criminal group collects a ransom payment but does not fulfill its promise (such as deleting stolen data), instead disappearing with the money.
Ethical considerations

This study does not involve human subjects, collect personal data collection, or any form of intervention. All case studies presented in this work are based on publicly available information, open-source reports, and illustrative hypothetical scenarios created for educational purposes. No identifiable student data, teacher data, or institutional records were used. Because the research relies solely on secondary sources and constructed examples designed to build cyber awareness among Grades 9–12 students, formal ethics approval and informed consent were not required.

 Data availability

No data was generated or analyzed in this study. The work is based on publicly available information and illustrative case-study examples used solely for educational purposes.

 References AHA: Change Healthcare Cyberattack Underscores Urgent Need to Strengthen Cyber Preparedness for Individual Health Care Organizations and as a Field. 2024a Reference Source AHA: AHA Survey: Change Healthcare Cyberattack Significantly Disrupts Patient Care, Hospitals’ Finances. 2024b, March 15. Reference Source Alder S : Healthcare Data Breach Statistics – Updated for 2026. The HIPAA Journal. 2026, February 26. Reference Source Arctic Wolf: The Top 10 Manufacturing Industry Cyber Attacks. 2026, January 22. Reference Source BBC News: JLR hack could see thousands laid off - MP. 2025a, September 17. Reference Source BBC News: JLR hack is costliest cyber attack in UK history, say analysts. 2025b, October 22. Reference Source Beerman J Berent D Falter Z : A review of colonial pipeline ransomware attack. 2023 IEEE/ACM 23rd international symposium on cluster, cloud and internet computing workshops (CCGridW). IEEE;2023, May; pp.8–15. Bostrom A Anselin L Farris J : Visualizing seismic risk and uncertainty: A review of related research. Ann. N. Y. Acad. Sci. 2008;1128(1):29–40. Burgess M : 22 A Cyberattack on Jaguar Land Rover Is Causing a Supply Chain Disaster. Wired;2025, September. Reference Source Cervini J Rubin A Watkins L : Don’t drink the cyber: Extrapolating the possibilities of Oldsmar’s water treatment cyberattack. International Conference on Cyber Warfare and Security. 2022;17(1):19–25. 10.34190/iccws.17.1.29 CISA: Compromise of U.S. water treatment facilities. Cybersecurity and Infrastructure Security Agency CISA. 2021a. Reference Source CISA: DarkSide ransomware: Best practices for preventing business disruption from ransomware attacks. Cybersecurity and Infrastructure Security Agency CISA;2021b. Reference Source CISA: Food and agriculture cybersecurity checklist and resources. Cybersecurity and Infrastructure Security Agency;2024. Reference Source Cremer F Sheehan B Fortmann M : Cyber risk and cybersecurity: a systematic review of data availability. The Geneva Papers on Risk and Insurance Issues and Practice. 2022;47(3):698–736. 10.1057/s41288-022-00266-6 Cyber Defense Magazine:2018. Reference Source Cybercraft:2018. Reference Source Cyber-Plan: The impact of the cyber attack on Duvel Moortgat brewery. 2024. Reference Source Cybersecurity CI : Framework for improving critical infrastructure cybersecurity. 2018. Reference Source DOE: Colonial Pipeline cyber incident. U.S. Department Of Energy;2021. Reference Source EASA: Opinion on Management of information security risks. 2021. Reference Source EPA: EPA cybersecurity for the water sector. US Environmental Protection Agency (EPA);2020, December 23. Reference Source Erkan-Barlow A Ngo T Goel R : An in-depth analysis of the impact of cyberattacks on the profitability of commercial banks in the United States. Journal of Global Business Insights. 2023.8(2):120–135. 10.5038/2640-6489.8.2.1246 European Union Aviation Safety Agency (EASA): Safety Information Bulletin. 2023. Reference Source FBI: A Case Study of the Capital One Data Breach. 2019. Reference Source FBI: Ransomware attacks on agricultural cooperatives (Private Industry Notification PIN-20220420-001). Federal Bureau of Investigation;2022. Reference Source Fliegelman A Stemp D : The Cyberattack on Change Healthcare:Lessons for Financial Stability (OFR Brief Series 24–05). Office of Financial Research, U.S. Department of the Treasury;2024 November 13. Reference Source Framework for Improving Critical Infrastructure: Reference Source GAO (Government Accountability Office): GPS Disruptions. 2021. Reference Source GAO (Government Accountability Office): Critical Infrastructure Protection. 2024. Reference Source Gatlan S : Duvel says it has "more than enough" beer after ransomware attack. BleepingComputer;2024, March 6. Reference Source Gatlan S : Jaguar Land Rover confirms data theft after recent cyberattack. 2025, September 3. Reference Source Ghanbari H Koskinen K Wei Y : From SolarWinds to Kaseya: The rise of supply chain attacks in a digital world. J. Inf. Technol. Teach. Cases. 2024;20438869241299823. 10.1177/20438869241299823 Goodell JW Corbet S : Commodity market exposure to energy-firm distress: Evidence from the Colonial Pipeline ransomware attack. Financ. Res. Lett. 2023.51(103329):103329. 10.1016/j.frl.2022.103329 Greig J : A strumous ransomware gang takes credit for the attack on Belgian brewer Duvel. The Record. 2024, March 7. Reference Source Healthcare IT : The Cost of Change Healthcare Ransomware Attack to Reach $2.87bn in 2024. 2024. Reference Source ICAO Annex 10 – Aeronautical Telecommunications: Reference Source Colorado DOT offers lessons learned after recovering from two 2018 ransomware attacks: Reference Source NTSB Lessons Learned and Lives Saved: Reference Source Office of the Comptroller of the Currency:2020. Reference Source Humphreys TE Ledvina BM Psiaki ML : Assessing the spoofing threat: Development of a portable GPS civilian spoofer. Proceedings of the 21st International technical meeting of the satellite division of the institute of navigation (ION GNSS 2008). 2008, September; pp.2314–2325. Hyperproof Team: Understanding the Change Healthcare breach and its impact on security compliance. Hyperproof;2026, February 24. Reference Source IBM Security: Cost of a Data Breach Report. 2023. Reference Source ICAO (International Civil Aviation Organization): Resolution A41–19: Addressing Cybersecurity in Civil Aviation. 2022. Reference Source James W : 8 recent cyber attacks on food production and agriculture. Wisdiam. 2024, October 6. Reference Source Jones C : The Bank of England says JLR's cyberattack contributed to the UK's unexpectedly slower GDP growth. The Register;2025, November 7. Reference Source Kamiya S Kang J-K Kim J : Risk management, firm reputation, and the impact of successful cyberattacks on target firms. J. Financ. Econ. 2021.139(3):719–749. 10.1016/j.jfineco.2019.05.019 Kerns AJ Shepard DP Bhatti JA : Unmanned aircraft capture and control via GPS spoofing. Journal of field robotics. 2014;31(4):617–636. Kulkarni A Wang Y Gopinath M : A review of cybersecurity incidents in the food and agriculture sector. J. Agric. Food Res. 2025;102245. Lee J Guzman MC de Wang J : Investigating perceptions about risk of data breaches in financial institutions: A routine activity-approach. Comput. Secur. 2022;121(102832):102832. 10.1016/j.cose.2022.102832 Liu C Babar MA : Corporate cybersecurity risk and data breaches: A systematic review of empirical research. Aust. J. Manag. 2026;51(1):62–92. 10.1177/03128962241293658 Mascellino A : Flagstar bank MOVEit breach affects 800K customer records. Infosecurity Magazine;2023. Reference Source McCallie D Butts J Mills R : Security analysis of the ADS-B implementation in the next generation air transportation system. Int. J. Crit. Infrastruct. Prot. 2011;4(2):78–87. Milmo D : Hackers linked to M&S breach claim responsibility for Jaguar Land Rover cyber-attack. The Guardian. 2025, September 3. Reference Source Mittal M : Colonial Pipeline cyberattack drives urgent reforms in cybersecurity and critical infrastructure resilience. International Journal of Oil Gas and Coal Engineering. 2024;12(5):106–119. 10.11648/j.ogce.20241205.11 NIST: Cybersecurity framework. NIST;2018a. Reference Source NIST: Cybersecurity framework. NIST;2018b. Reference Source NIST: Framework for improving critical infrastructure cybersecurity, version 1.1. National Institute of Standards and Technology;2018c. 10.6028/nist.cswp.04162018 NIST: Framework for Improving Critical Infrastructure Cybersecurity, version 1.1. National Institute of Standards and Technology;2018d. Reference Source Pearson J : Jaguar Land Rover hack cost UK economy an estimated $2.5 billion, report says. 2025, October 22. Reference Source Raghuprasad C : GhostSec's joint ransomware operation and evolution of their arsenal. Cisco Talos Blog. 2024, March 5. Reference Source Schäfer M Strohmeier M Lenders V : Bringing up OpenSky: A large-scale ADS-B sensor network for research. IPSN-14 proceedings of the 13th international symposium on information processing in sensor networks. IEEE;2014, April; pp.83–94. Shepard, Cybersecurity Incident Databse:Feb, 2018. Reference Source Shepard DP Bhatti JA Humphreys TE : Drone hack. Gps. World. 2012;23(8):30–33. Strohmeier M Martinovic I Lenders V : Securing the air–ground link in aviation. The Security of Critical Infrastructures: Risk, Resilience and Defense. Cham: Springer International Publishing;2020; pp.131–154. Tsvetanov T Slaria S : The effect of the Colonial Pipeline shutdown on gasoline prices. Econ. Lett. 2021;209(110122):110122. 10.1016/j.econlet.2021.110122 Tuptuk N Hazell P Watson J : A systematic review of the state of cyber-security in water systems. Water. 2021;13(1):81. 10.3390/w13010081 U.S. Department of Justice: Capital One hacker charged with data breach affecting over 100 million people. 2019. UK Government: Joint statement on government-industry supplier meeting regarding Jaguar Land Rover cyber incident. GOV.UK;2025, September 19. Reference Source Vallance C Leggett T : Jaguar Land Rover production severely hit by cyber-attack. BBC News. 2025, September 2. Reference Source Vasquez C :2023. Did someone really hack into the Oldsmar, Florida, water treatment plant? New details suggest maybe not. CyberScoop; Reference Source Workgroup, G. S: GPS spoofing: Final report of the GPS spoofing workgroup. London, UK: GPS Spoofing WorkGroup;2024. You J : Strengthening cybersecurity of water infrastructure through legislative actions. J. Am. Water Resour. Assoc. 2022;58(2):282–288. 10.1111/1752-1688.12995 Young S : Jaguar Land Rover cyberattack shutdown to hit four weeks. The Irish Times. 2025, September 23. Reference Source Zeng KC Shu Y Liu S : A practical GPS location spoofing attack in road navigation scenario. Proceedings of the 18th international workshop on mobile computing systems and applications. 2017, February; pp.85–90.