INDUSTRY FACT FILE · POWER & ELECTRICITY

Five New Case Studies in Power Sector Security

Original 2026 case studies, each written as a blog post, showing how current threats play out for power utilities and how Codec Networks services break the attack chain.

In this document 1.  About these case studies 2.  Case Study 1: The Load Dispatch Centre Intrusion 3.  Case Study 2: The Substation Remote Access Nobody Logged 4.  Case Study 3: The DISCOM Billing Ransomware 5.  Case Study 4: The Smart Meter Head-End That Could Switch Off a City 6.  Case Study 5: The Plant DCS on the Corporate Network

These five case studies were written for this document set and have not been published elsewhere. Each is a composite scenario combining attack techniques and control failures widely observed in power systems with the obligations that apply in India as of October 2026—in particular the CEA (Cyber Security in Power Sector) Regulations, 2026 (as reported), CERT-In's Directions and NCIIPC expectations.

Important disclosure The organisations described are fictional and the scenarios are illustrative. They are not accounts of real incidents, and they are not Codec Networks client engagements or claims of achieved outcomes. Their value lies in showing how connected weaknesses form an attack chain, which controls break it, and which services test those controls.

Case study	Organisation type	Core threat	Regulatory lens	Primary bundles
1. The Load Dispatch Centre Intrusion	State load dispatch centre	State-linked espionage targeting SCADA/EMS	CEA Regulations; CERT-In; NCIIPC	B7, B3, B8
2. The Substation Remote Access Nobody Logged	Transmission utility	Abuse of OEM remote access	CEA Regulations; contracts	B3, B9, B7
3. The DISCOM Billing Ransomware	Distribution company	Ransomware in IT probing distribution SCADA	CEA Regulations; CERT-In; DPDP	B7, B10, B8
4. The Smart Meter Head-End That Could Switch Off a City	Distribution company	Weak head-end administration	CEA Regulations; DPDP	B1, B2, B7
5. The Plant DCS on the Corporate Network	Thermal generating station	Malware reaching DCS through IT	CEA Regulations; CERT-In	B3, B1, B10

The attackers were patient. They wanted access, not attention.

At a glance
Organisation	A state load dispatch centre (“SLDC A”)
Threat	Phished engineer credentials used to probe for paths from IT into SCADA/EMS
Why it is new	Grid control centres are strategic targets
Codec Networks services	Threat hunting, segmentation review, OT forensics (Bundles B7, B3, B8)

The scenario

An SLDC A engineer received a tailored email referencing a real grid meeting and entered credentials on a fake page.

Attackers used the account to explore the corporate network and looked for connections into SCADA/EMS, including shared jump hosts.

A threat intelligence alert prompted a hunt that found the intruders before they reached control systems.

Figure 8: Illustrative attack path for Case Study 1 and the controls that break it.

What went wrong

• MFA was not phishing-resistant.
• Jump hosts were shared between IT and OT tasks.
• No OT network monitoring.
• No regular threat hunting.

The impact

SLDC A reported the incident, rebuilt jump hosts and accelerated separation and monitoring projects.

The regulatory lens

• CEA Regulations 2026 (as reported): incident reporting to CSIRT-Power and CERT-In within six hours; separation of OT networks.
• NCIIPC: coordination for critical information infrastructure.
• CERT-In Directions: reporting and log retention.

How Codec Networks would help

Need	Codec Networks response	Bundle
Hunt	Threat hunting for state-actor tradecraft	B7
Separate	IT/OT and jump host architecture review	B3
Investigate	OT-aware forensics	B8

Key lessons Use phishing-resistant MFA. Never share jump hosts across IT and OT. Monitor OT networks. Hunt regularly.

The connection was there for emergencies. It was used for one.

At a glance
Organisation	A state transmission utility (“Transco B”)
Threat	Stolen OEM credentials used over a permanent connection to change relay settings
Why it is new	Vendor access can reach protection systems directly
Codec Networks services	Remote access review, vendor assessment, configuration monitoring (Bundles B3, B9, B7)

The scenario

Transco B's substation automation vendor maintained an always-on remote connection for support.

An attacker stole the vendor's credentials and connected at night, changing protection relay settings at a substation.

Feeders tripped unexpectedly, causing a local outage and an urgent investigation.

Figure 9: Illustrative attack path for Case Study 2 and the controls that break it.

What went wrong

• Vendor access was always on.
• No MFA or session recording.
• Relay settings were not monitored for change.
• Vendor security was never assessed.

The impact

Transco B restored supply, reported the incident and renegotiated vendor access terms.

The regulatory lens

• CEA Regulations 2026 (as reported): vendor accountability, OT protection and six-hour incident reporting.
• Grid codes: coordination with load dispatch centres.
• Contracts: vendor security obligations.

How Codec Networks would help

Need	Codec Networks response	Bundle
Control access	Brokered, recorded remote access review	B3
Assess vendors	OEM security assessment	B9
Watch settings	Configuration integrity monitoring	B7

Key lessons Make vendor access on-request. Require MFA and recording. Monitor relay settings. Assess OEM security.

Bills stopped. Then the attackers went looking for the switches.

At a glance
Organisation	A DISCOM (“Discom C”) serving several million consumers
Threat	Ransomware encrypting billing and portals, then probing distribution SCADA
Why it is new	IT incidents at DISCOMs can threaten supply
Codec Networks services	SOC monitoring, ransomware exercises, incident response (Bundles B7, B10, B8)

The scenario

A billing clerk opened a malicious attachment, and ransomware spread across Discom C's corporate network.

Billing, collections and the consumer portal stopped. Logs later showed attackers scanning for distribution SCADA servers.

Segmentation installed the previous year blocked the path, but recovery of billing took days.

Figure 10: Illustrative attack path for Case Study 3 and the controls that break it.

What went wrong

• EDR alerts were not monitored 24x7.
• Billing backups were partly online.
• Some IT-to-OT rules were overly broad.
• Ransomware recovery had not been rehearsed.

The impact

Discom C lost revenue, faced consumer complaints and assessed DPDP exposure for consumer data.

The regulatory lens

• CEA Regulations 2026 (as reported): incident reporting and crisis management with annual drills.
• CERT-In Directions: incidents reported within six hours.
• DPDP Act and Rules: consumer data safeguards once provisions commence.

How Codec Networks would help

Need	Codec Networks response	Bundle
Detect early	24x7 SOC with EDR	B7
Rehearse	Ransomware crisis exercises	B10
Recover	Ransomware response and restoration	B8

Key lessons Monitor endpoints around the clock. Keep billing backups offline. Tighten IT-to-OT rules. Rehearse recovery.

One screen could disconnect thousands of homes.

At a glance
Organisation	A DISCOM (“Discom D”) rolling out smart meters
Threat	Compromised head-end admin access enabling mass disconnect commands
Why it is new	Smart metering concentrates control of supply
Codec Networks services	Head-end testing, application review, monitoring (Bundles B1, B2, B7)

The scenario

Discom D's smart meter head-end system used shared admin accounts without MFA.

An attacker who obtained an admin password tested a disconnect command on a block of meters, cutting supply to a neighbourhood.

Discom D restored supply and found that no approval or rate limit existed for bulk commands.

Figure 11: Illustrative attack path for Case Study 4 and the controls that break it.

What went wrong

• Shared admin accounts without MFA.
• No approval for bulk disconnects.
• No rate limits on commands.
• Head-end commands were not monitored.

The impact

Discom D faced public criticism, an internal review and urgent redesign of head-end controls.

The regulatory lens

• CEA Regulations 2026 (as reported): protection of OT and connected IT, incident reporting within six hours.
• DPDP Act and Rules: consumer metering data safeguards once provisions commence.
• State regulations: supply obligations to consumers.

How Codec Networks would help

Need	Codec Networks response	Bundle
Test the head-end	Head-end and metering security testing	B1
Fix the application	Admin, approval and rate-limit review	B2
Watch commands	Monitoring of head-end commands	B7

Key lessons Use named admin accounts with MFA. Approve bulk commands. Rate-limit disconnects. Monitor head-end activity.

It started with a contractor's laptop.

At a glance
Organisation	A thermal generating station (“Genco E”)
Threat	Malware from an infected laptop spreading from IT to DCS operator stations
Why it is new	Flat plant networks let IT malware reach control systems
Codec Networks services	Plant segmentation, OT assessment, recovery drills (Bundles B3, B1, B10)

The scenario

A contractor connected an infected laptop to Genco E's network during maintenance.

Because DCS servers were reachable from corporate IT, self-spreading malware disrupted operator stations and historians.

Operators tripped units as a precaution, causing generation loss and grid coordination with the dispatch centre.

Figure 12: Illustrative attack path for Case Study 5 and the controls that break it.

What went wrong

• DCS was reachable from corporate IT.
• No plant DMZ.
• Contractor devices were not controlled.
• OT recovery had not been drilled.

The impact

Genco E lost generation, reported the incident and launched a segmentation programme.

The regulatory lens

• CEA Regulations 2026 (as reported): OT separation, incident reporting within six hours and annual mock drills.
• Grid codes: coordination with load dispatch centres during unit trips.
• CERT-In Directions: reporting and logs.

How Codec Networks would help

Need	Codec Networks response	Bundle
Segment the plant	IT/OT segmentation and DMZ design	B3
Assess the DCS	OT-safe DCS assessment	B1
Drill recovery	OT incident and recovery drills	B10

Key lessons Keep DCS off the corporate network. Build a plant DMZ. Control contractor devices. Drill OT recovery.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com