  This study presents a critical review of disclosed, documented, and malicious
cybersecurity incidents in the water sector to inform safeguarding efforts
against cybersecurity threats. The review is presented within a technical
context of industrial control system architectures, attack-defense models, and
security solutions. Fifteen incidents were selected and analyzed through a
search strategy that included a variety of public information sources ranging
from federal investigation reports to scientific papers. For each individual
incident, the situation, response, remediation, and lessons learned were
compiled and described. The findings of this review indicate an increase in the
frequency, diversity, and complexity of cyberthreats to the water sector.
Although the emergence of new threats, such as ransomware or cryptojacking, was
found, a recurrence of similar vulnerabilities and threats, such as insider
threats, was also evident, emphasizing the need for an adaptive, cooperative,
and comprehensive approach to water cyberdefense.
