Sep 8, 2026 · 29 min
Volt Typhoon breached a utility but hit a firewall
How China’s Volt Typhoon hacked a small-town utility
The intrusion shows how a small utility can become a foothold for broader critical-infrastructure threats—and why segmentation and information-sharing matter.
- 1Volt Typhoon entered through an unpatched third-party vulnerability rather than directly compromising operational systems.
- 2Network segmentation and firewalls kept attackers away from the systems controlling Littleton’s water and power.
- 3The episode argues that utilities must share incidents because quiet access today could support larger attacks tomorrow.
Don't miss
Nick Lawler describes how network segmentation kept Volt Typhoon away from the systems controlling the utility’s water and power.
The brief
A suspicious call and an unexpected federal visit revealed that Volt Typhoon had entered the Littleton Municipal Utility’s IT network, turning a small Massachusetts utility into a national-security story.
Dragos investigators traced the activity to malicious infrastructure in China and an unpatched vulnerability at a third-party IT vendor, not a failure in the utility’s operational controls.
The breach stopped short of the systems controlling water and power because segmentation and firewalls separated them from the compromised IT network—a quiet technical success with major consequences.
The episode frames Volt Typhoon’s goal as persistent, covert access rather than immediate disruption, using smaller organizations as possible test environments for attacks that could scale.
Nick Lawler and experts including John Burns and Sue Gordon argue that utilities must share incidents, because any organization can be either a target or a pathway.