Theft of Operational Information (T0882) is the loss of the documents and data that describe how an industrial process works: drawings, network diagrams, controller projects, schedules and process records. MITRE ATT&CK for ICS treats it as an Impact technique in its own right, because the theft can be the goal (intellectual property, recipes) or the reconnaissance for a later attack on the process. Its procedure examples run from Duqu and Flame to the December 2025 attacks on Polish energy sites, where stolen operational information was used to plan the OT attack. This guide is for OT security engineers, data owners and SOC analysts. It covers what information is at risk, where it lives, how to reduce and protect it, and how to detect its theft when ATT&CK itself says no standard detection method exists.
Key takeaways
- The information usually lives in IT, not on controllers. File servers, SharePoint, email, engineering laptops and historians hold most operational documentation, so IT data controls matter for OT.
- Theft is often a precursor. In the 2025 Poland attacks, CERT Polska found the attacker searched hosts named "scada", took screenshots of automation systems and downloaded files about SCADA and OT modernisation before the destructive phase.
- ATT&CK has no standard detection for T0882. Detection relies on the collection and exfiltration steps around it: access to repositories, bulk reads and unusual outbound transfers.
- Less data means less to steal. ATT&CK's Operational Information Confidentiality mitigation starts with minimising distribution and storage.
- Treat controller projects and configurations as sensitive assets. They need access control, integrity checks and a register of copies, including those held by integrators.
What T0882 covers
ATT&CK for ICS (v20) describes T0882 as stealing operational information on a production environment as a direct mission outcome, for personal gain or to inform future operations. The information named includes design documents, schedules, rotational data and similar artifacts that give insight into operations. ATT&CK also cites the Bowman Dam incident, where adversaries probed systems for operational data. The technique has no platform in ATT&CK (it is an outcome, not a host behaviour), which is why the collection techniques around it carry the detection load.
| Technique | Role | Relationship to T0882 |
|---|---|---|
| T0811 Data from Information Repositories | Collection | Reading SharePoint, file shares, databases and historians that hold the information |
| T0802 Automated Collection | Collection | Scripts or OPC queries gathering data at scale |
| T0882 Theft of Operational Information | Impact | The loss itself, whatever route was used |
| T1041 and T1567 (Enterprise) | Exfiltration | Moving the data out over C2 or web services |
See the T1213 Data from Information Repositories Defensive Guide for the enterprise collection view and T1567 Exfiltration Over Web Service for the outbound step.
Procedure examples
| Example | What ATT&CK records |
|---|---|
| ACAD/Medre.A (S1000) | Collects AutoCAD files with drawings, which may contain operational information |
| Duqu (S0038) | Gathered intelligence and assets from industrial infrastructure and system manufacturers to support a future attack on a third party |
| Flame (S0143) | Collects AutoCAD design data, Visio diagrams and other documents that may contain operational information |
| REvil (S0496) | Sends exfiltrated data to its C2 system using HTTPS POST |
| 2025 Poland Wiper Attacks (C0063) | Adversaries stole sensitive operational information that was used to plan the attack on OT systems |
The 2025 Poland case
CERT Polska's report on the attacks of 29 December 2025 covers at least 30 wind and solar farms, a large combined heat and power (CHP) plant and a manufacturing company. At the CHP plant the attack followed a long infiltration. The report describes repeated SMB access to file systems, focused on systems with "scada" in their names, enumeration of NAS shares, screenshots of devices with a focus on industrial automation systems, and theft of the Active Directory database and firewall configuration files. Using credentials from the on-premises network, the attacker also downloaded selected data from Exchange, Teams and SharePoint, and was particularly interested in files and email about OT network modernisation and SCADA systems. The lesson is that the planning data for an OT attack came largely from ordinary IT collaboration systems.
Where operational information lives
| Store | Typical content | Key control |
|---|---|---|
| Engineering file shares and NAS | Controller project files, drawings, I/O lists, network diagrams | Group-based access per site, no "everyone" shares, access logging |
| Collaboration (SharePoint, Teams, email) | Modernisation plans, vendor correspondence, test reports | Sensitivity labels, restricted sites for OT projects, external sharing off |
| Engineering workstations and laptops | Local project copies, vendor tools, credentials | Disk encryption, no personal cloud sync, removable media control |
| Historians and their replicas in IT | Process values, batch and recipe data | Read access by role, one-way replication to the DMZ |
| Network and security device configs | Firewall rules, VPN settings | Stored in a protected repository, not on shared drives |
| Integrators and vendors | Copies of projects and drawings | Contract clauses on storage, return and deletion |
Engineering hosts are covered in the Engineering Workstation Security Guide, and the DMZ pattern for historian replication in the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide.
Prevention: the ATT&CK mitigations in practice
| Mitigation | ATT&CK guidance | Practical step |
|---|---|---|
| M0809 Operational Information Confidentiality | Minimise distribution and storage, or obfuscate (facility cover terms, codenames), while recognising some information must stay available for engineering and maintenance | Classify OT documents, keep master copies in one controlled repository, use cover terms in widely shared material |
| M0922 Restrict File and Directory Permissions | Protect locally stored files with proper permissions | Least-privilege groups on engineering shares, quarterly access review |
| M0803 Data Loss Prevention | Protect information on processes, facility locations, device configurations, programs and databases | DLP rules for project file types and labelled OT documents on email, web and cloud uploads |
| M0941 Encrypt Sensitive Information | Encrypt operational data with strong confidentiality needs, such as trade secrets and recipes | Encryption at rest on engineering laptops and repositories, encrypted transfer to vendors |
Two controls from government guidance also apply. CISA and partner agencies recommend segmenting IT and OT with a demilitarised zone that passes control data to enterprise systems, which keeps OT data flows one-way and known. The 2022 joint advisory on ICS attack tools recommends offline backups of firmware and controller configurations with hash verification, which gives you an authoritative record of what exists and lets you check integrity.
Where identity fits
In the Poland case, stolen on-premises credentials opened the cloud collaboration data. Operational information is protected by the identities that can read it: engineering groups, service accounts used by historian replication and backup jobs, and vendor accounts with share access. Review these with the data owner, remove standing vendor access to document stores, and give replication and backup accounts read access only to what they move. See the Service Account Security Guide.
Detection when there is no standard method
ATT&CK's detection strategy for T0882 (DET0732) states that no standard detection method currently exists. Build detection around the steps that must happen first:
- Repository access: alert on accounts reading OT project sites or engineering shares they have not used before, and on bulk downloads of project file types.
- Host name targeting: the CERT Polska case showed SMB access focused on "scada" hosts. Watch SMB sessions to SCADA, historian and engineering hosts from IT hosts that have no reason to connect.
- Screenshots and archives: archive creation and screen capture tools on HMI and engineering hosts outside normal use.
- Cloud collaboration: mass file downloads or sync from OT-labelled sites, sign-ins from new locations by accounts that hold OT access.
- Egress: outbound transfers from the OT DMZ or engineering subnets to destinations outside the approved list.
Network monitoring for the OT side is covered in the OT Network Security Monitoring Guide.
Implementation in phases
- Find it: inventory where operational documents, project files and configurations are stored, including copies held by integrators.
- Classify and consolidate: label OT documents, move masters into a controlled repository and retire stray copies.
- Restrict: least-privilege groups, external sharing off, vendor access time-bound. Pilot on one site and keep the previous permission export to roll back.
- Detect: run DLP and access analytics in audit mode, tune with engineering, then enforce.
- Verify: hash-verified offline backups of controller configurations and a yearly check that the register matches reality.
Response when theft is suspected
- Assume planning: treat confirmed theft of OT documentation as a possible precursor and raise monitoring on the systems described in the stolen data.
- Scope what left: use repository audit logs and egress records to list documents and configurations taken.
- Change what the data reveals: rotate credentials and review firewall rules and remote access paths exposed in stolen configurations.
- Notify: involve legal and the data owner for trade secret, contractual and sector reporting duties.
Metrics
- Share of OT document stores with a named owner and access review in the last quarter.
- Number of accounts with read access to controller projects, trended down.
- Share of OT document locations covered by DLP and access logging.
- Uncontrolled copies found and removed per review.
- Share of controllers with a hash-verified offline configuration backup.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| ATT&CK for ICS | T0882, DET0732, M0809, M0922, M0803, M0941 | Technique and mitigations |
| NIST SP 800-53 Rev. 5 | AC-3, AC-6, SC-28, SC-8, SI-4 | Access enforcement, least privilege, protection at rest and in transit, monitoring |
| NIST CSF 2.0 | PR.DS-01, PR.AA-05, DE.CM-01 | Data at rest, access permissions, network monitoring |
| NIST SP 800-82 Rev. 3 | OT overlay guidance | Applying these controls in OT |
Common failure patterns
- OT documents on general file shares: any compromised IT account can read network diagrams and projects.
- Collaboration sites without labels: modernisation projects in SharePoint or Teams are open to large groups and external guests.
- Integrator copies nobody tracks: projects stay on contractor laptops years after handover.
- Waiting for a T0882 alert: there is no standard one, so programmes that do not monitor collection steps see nothing.
- Configs stored with credentials: stolen device configurations reveal both topology and access.
Practitioner checklist
- Inventory every store of OT documents, projects and device configurations, including third-party copies.
- Classify OT documents and keep master copies in one controlled repository.
- Apply least-privilege groups and quarterly access reviews to engineering shares and OT collaboration sites.
- Turn off external sharing on OT project sites and time-bound vendor access.
- Deploy DLP for labelled OT documents and project file types, audit mode first.
- Alert on bulk reads and on SMB access to SCADA and engineering hosts from unexpected sources.
- Encrypt engineering laptops and transfers to vendors.
- Keep hash-verified offline backups of controller configurations.
Standards and references
- MITRE ATT&CK for ICS: Theft of Operational Information (T0882)
- MITRE ATT&CK for ICS: Operational Information Confidentiality (M0809)
- CERT Polska: Energy Sector Incident Report 2025
- NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
- CISA, FBI, EPA and DOE: Primary Mitigations to Reduce Cyber Threats to Operational Technology
- CISA, DOE, NSA and FBI: APT Cyber Tools Targeting ICS/SCADA Devices (AA22-103A)
Related NHI Mgmt Group resources: MITRE ATT&CK for ICS Guide · OT Security Guide · Engineering Workstation Security Guide · OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide