What happened

Dragos confirmed a significant compromise of Servicios de Agua y Drenaje de Monterrey's enterprise IT network by an unknown actor during a wider campaign against Mexican government organizations. Recovered artifacts showed extensive use of Anthropic's Claude for intrusion planning and tool development and OpenAI GPT models for processing stolen data. After identifying an internal vNode industrial gateway as an OT-adjacent target, the actor used AI-generated credential lists in two password-spray attempts. Both failed, and Dragos found no evidence that the actor gained visibility into or control of the underlying operational environment. This record therefore describes a successful IT breach and failed OT pivot, not a water-service disruption.

When cited sources give different casualty, damage or spill figures for this event, they’re reported side by side above rather than merged into one number. See how confidence levels work.