INDUSTRY FACT FILE · SMART CITIES, WATER & URBAN UTILITIES

Five New Case Studies in City and Water Utility Security

Original 2026 case studies, each written as a blog post, showing how current threats play out in smart city SPVs, municipal bodies, water utilities and urban services operators and how Codec Networks services break the attack chain.

In this document 1.  About these case studies 2.  Case Study 1: The Dosing Screen at Three in the Morning 3.  Case Study 2: The Command Centre That Went Dark 4.  Case Study 3: The Property Tax Portal Nobody Backed Up 5.  Case Study 4: The Footage That Left the Control Room 6.  Case Study 5: The Streetlights That Joined a Botnet

These five case studies were written for this document set and have not been published elsewhere. Each is a composite scenario combining attack techniques and control failures widely observed in cities and utilities with the obligations that apply in India as of October 2026—in particular CERT-In's Directions, government-entity guidelines and audit guidelines, NCIIPC, DPDP and MeitY's CCTV requirements.

Important disclosure The organisations described are fictional and the scenarios are illustrative. They are not accounts of real incidents, and they are not Codec Networks client engagements or claims of achieved outcomes. Their value lies in showing how connected weaknesses form an attack chain, which controls break it, and which services test those controls.

Case study	Organisation type	Core threat	Regulatory lens	Primary bundles
1. The Dosing Screen at Three in the Morning	City water supply board	Remote-desktop access used to change chemical dosing	CERT-In; state water duties; NCIIPC if notified	B1, B3, B7
2. The Command Centre That Went Dark	Smart city SPV	Ransomware spreading from the integrator into the ICCC	CERT-In; scheme conditions; DPDP	B9, B3, B8
3. The Property Tax Portal Nobody Backed Up	Municipal corporation	Ransomware and citizen data theft in collection season	CERT-In; government-entity guidelines; DPDP	B2, B3, B7
4. The Footage That Left the Control Room	Safe-city surveillance operator	Contractor export of surveillance and recognition data	DPDP; MeitY CCTV ER; police and state rules	B6, B1, B9
5. The Streetlights That Joined a Botnet	Urban services concessionaire	Default-credential IoT gateways hijacked and used to reach pumping telemetry	CERT-In; concession agreement; environmental consents	B11, B3, B7

The cursor moved on its own. The operator had ninety seconds to notice.

At a glance
Organisation	A city water board (“Waterco A”) running three treatment plants and forty pumping stations
Threat	A shared remote-desktop password used to reach a plant HMI and raise chlorine and alkali set-points
Why it is new	Indian plants carry the same contractor conveniences that enabled Oldsmar
Codec Networks services	SCADA assessment, remote access removal and brokering, OT monitoring (Bundles B1, B3, B7)

The scenario

Waterco A's O&M contractor had installed a remote-desktop tool on the main plant's HMI workstation—still running Windows 7—so engineers could support it from home. The password was shared across the contractor's team and had not changed in four years.

At 3 a.m. an intruder logged in, opened the chemical dosing screen and raised the chlorine and alkali set-points far beyond safe limits. The night operator saw the cursor move, took back control and reset the values within minutes; dosing alarms would have tripped later had he not.

Investigation found no MFA, no session logs, a flat network between the plant and the board's offices and the same remote-desktop tool at eleven pumping stations.

Figure 8: Illustrative attack path for Case Study 1 and the controls that break it.

What went wrong

• Remote-desktop tool exposed to the internet on a plant HMI.
• Shared, unchanged password with no MFA.
• No session logging or OT monitoring.
• No hard limits on critical set-points in the control system.

The impact

Waterco A avoided harm by luck, reported the incident, removed remote access from all plants, faced state government review and funded an independent SCADA assessment.

The regulatory lens

• CERT-In Directions: incident reported within six hours; logs needed for investigation.
• State water supply and public health duties: safe water supply obligations and state review.
• NCIIPC: coordination required if plant systems are notified as protected systems.

How Codec Networks would help

Need	Codec Networks response	Bundle
Know the exposure	SCADA and HMI assessment with safe, passive methods across plants and pumping stations	B1
Remove and broker	Remote access removal, brokered contractor access with MFA and recording, plant segmentation	B3
Watch the plant	OT monitoring and city SOC alerting on set-point and session anomalies	B7

Key lessons No remote-desktop tools on plant HMIs. Named accounts, MFA and recording for every contractor session. Hard limits and alarms on critical set-points. Monitor plant networks, not just office IT.

Twelve hundred cameras, every signal and the emergency dashboard—blind for five days.

At a glance
Organisation	A smart city SPV (“Cityco B”) operating an ICCC under a master system integrator's O&M contract
Threat	Infostealer malware on an integrator engineer's laptop yielding VPN credentials used to deploy ransomware across ICCC, VMS and traffic platforms
Why it is new	The integrator's weakness becomes the city's incident
Codec Networks services	MSI access programme, segmentation and backups, incident response (Bundles B9, B3, B8)

The scenario

Cityco B's integrator kept a standing VPN into the ICCC for O&M, shared among engineers. One engineer's personal laptop was infected with infostealer malware, and the VPN credentials were sold within days.

Attackers logged in on a Friday night, moved from the ICCC servers to the VMS, adaptive traffic and dashboard platforms—all on one network—and encrypted them, including the backup server.

For five days the city had no camera feeds, signals ran on fixed timings and the emergency dashboard was blank. The SPV discovered it had no offline backups and no record of who had connected to the ICCC in two years.

Figure 9: Illustrative attack path for Case Study 2 and the controls that break it.

What went wrong

• Standing shared VPN for the integrator without MFA.
• No segmentation between ICCC, VMS, traffic and office networks.
• Backups online and encrypted with the platforms.
• No vendor session logging or monitoring.

The impact

Cityco B lost five days of city operations, rebuilt platforms at its own cost, reported the incident, faced state review and media scrutiny and renegotiated its O&M contract with security clauses.

The regulatory lens

• CERT-In Directions: incident reported within six hours.
• Scheme and O&M conditions: continuity and security obligations under the mission and contract.
• DPDP: footage and recognition data on the VMS as personal data.

How Codec Networks would help

Need	Codec Networks response	Bundle
Control the integrator	MSI and vendor access programme: brokered, named, recorded access; vendor assessment; contract clauses	B9
Separate and recover	ICCC segmentation design, immutable backups and tested restores	B3
Respond and learn	Incident response, forensics, root cause and reporting support	B8

Key lessons Broker and record every integrator session. Segment the ICCC from everything else. Keep platform backups offline and test them. Put security into O&M contracts before, not after.

Tax season opened with a ransom note and a queue outside every ward office.

At a glance
Organisation	A municipal corporation (“Munico C”) serving three million residents through one e-governance platform
Threat	Exploitation of an unpatched, internet-facing application server leading to data exfiltration and ransomware across tax, billing and certificate systems
Why it is new	Municipal portals are exposed by design and hold data on millions
Codec Networks services	Portal testing and patch governance, backups, SOC (Bundles B2, B3, B7)

The scenario

Munico C's e-governance platform ran property tax, water billing and birth and death certificates. A critical vulnerability in its application server had been public for five months; nobody owned patching after the vendor's contract lapsed.

Attackers exploited it in the first week of the tax-collection season, exported citizen records—names, addresses, property identifiers and payment details—and encrypted the databases.

Counters fell back to paper; collections dropped by half; residents received fake payment links. Tape backups were three days old and the restore took two weeks.

Figure 10: Illustrative attack path for Case Study 3 and the controls that break it.

What went wrong

• Unpatched application server exposed to the internet with no patch ownership.
• Backups on tape every three days, never restore-tested.
• No EDR or monitoring on municipal servers.
• Citizen data unclassified and exportable in bulk.

The impact

Munico C lost two weeks of services and collections, notified residents, faced state audit observations and assembly questions, reported to CERT-In and rebuilt its platform governance.

The regulatory lens

• CERT-In Directions: incident reported within six hours; logs needed for investigation.
• CERT-In government-entity guidelines: baseline controls such as patching, asset inventory and a designated CISO were absent.
• DPDP: citizen personal data exfiltrated; breach intimation duties from May 2027, subject to applicable exemptions.

How Codec Networks would help

Need	Codec Networks response	Bundle
Test and patch	Portal, app and API penetration testing with patch governance	B2
Recover	Immutable backups, tested restores and a manual counter playbook	B3
Detect early	EDR and 24x7 SOC for municipal IT	B7

Key lessons Own patching even when vendors change. Back up immutably and rehearse restores. Monitor the servers citizens depend on. Classify citizen data and control exports.

Nothing was encrypted and no alarm rang. The city's cameras had simply been working for someone else.

At a glance
Organisation	A safe-city operator (“Safeco D”) running 4,000 cameras, ANPR and facial recognition for a city police department
Threat	A contractor using broad VMS export rights to extract clips and vehicle-recognition logs over months and sell them
Why it is new	Surveillance data is personal data at scale, and insiders need no exploit
Codec Networks services	Surveillance governance and DPDP, VMS assessment, contractor assurance (Bundles B6, B1, B9)

The scenario

Safeco D's VMS gave every integrator and contractor account the same export rights as supervisors. Exports were not logged, and accounts were never reviewed.

A contractor exported camera clips and ANPR logs on request for recovery agents and private investigators for eight months. A journalist traced two stalking cases to the leaked data.

The city could not establish who had exported what, under what authority, or how many people were affected; several cameras had never been tested against MeitY's requirements.

Figure 11: Illustrative attack path for Case Study 4 and the controls that break it.

What went wrong

• Broad export rights for contractors with no least privilege.
• No export logging or review.
• No surveillance governance—purpose, retention, access, audit.
• Contractor accounts never recertified or removed.

The impact

Safeco D faced public and legislative scrutiny, suspended contractor access, funded an independent assessment and rebuilt its surveillance governance with the police department.

The regulatory lens

• DPDP: footage and recognition data identifying individuals is personal data; access, purpose and retention controls apply, subject to any state exemptions.
• MeitY CCTV essential requirements: cameras procured from April 2025 must meet security requirements with STQC testing.
• Police and state rules: lawful access and record-keeping obligations for surveillance systems.

How Codec Networks would help

Need	Codec Networks response	Bundle
Govern the data	Surveillance governance review and DPDP programme: purpose, retention, access, export logging	B6
Test the platform	VMS, analytics and access control assessment with MeitY ER evidence	B1
Control contractors	Contractor assurance, least privilege, recertification and offboarding	B9

Key lessons Least privilege and named accounts on video platforms. Log and review every export. Write down purpose, retention and authority for surveillance. Recertify and remove contractor access.

The lights still worked. The sewage pumping station did not.

At a glance
Organisation	A lighting concessionaire (“Lightco E”) operating 60,000 smart streetlights and, under a second contract, sewage pumping station telemetry
Threat	Cellular gateways with default credentials enrolled in a botnet and used to pivot into telemetry, suppressing pump alarms
Why it is new	IoT roll-outs create thousands of exposed doors into city networks
Codec Networks services	IoT assessment, isolation, device management and monitoring (Bundles B11, B3, B7)

The scenario

Lightco E deployed streetlight controllers through cellular gateways that kept default administrator credentials and a web interface reachable from the internet. Automated scanners enrolled thousands into a botnet within weeks.

The gateways shared an APN and network with the telemetry Lightco E ran for the city's sewage pumping stations. Attackers used a compromised gateway to reach the telemetry server and suppressed pump status alarms.

A wet well overflowed into a lake for two days before residents complained. The city invoked the concession's penalty clauses and environmental authorities opened an inquiry.

Figure 12: Illustrative attack path for Case Study 5 and the controls that break it.

What went wrong

• Default credentials and internet exposure on field gateways.
• Shared network between lighting and pumping telemetry.
• No device inventory or firmware management.
• No anomaly monitoring of field traffic or alarm suppression.

The impact

Lightco E paid concession penalties, faced an environmental inquiry, reported the incident and re-architected its field networks and device management.

The regulatory lens

• CERT-In Directions: incident reported within six hours.
• Concession agreement: service, security and continuity clauses invoked by the city.
• Environmental consents: inquiry into the overflow by the pollution control board.

How Codec Networks would help

Need	Codec Networks response	Bundle
Assess before deploying	IoT and gateway security assessment, device credential and firmware hardening	B11
Isolate	Separate lighting, telemetry and corporate networks with controlled flows	B3
Watch the field	Continuous asset discovery and anomaly monitoring through the city SOC	B7

Key lessons Assess every IoT roll-out before go-live. Never share networks between lighting and critical telemetry. Change defaults and manage firmware centrally. Monitor field devices for scanning and alarm suppression.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com