Maroochy Shire
A rejected job applicant kept his contractor's radio and laptop, drove around an Australian sewage network for months, and remote-released a million liters into the parks and rivers.
In early 2000, residents of Maroochy Shire, a coastal council north of Brisbane in Queensland, began noticing untreated sewage in creeks, parks, and the grounds of a Hyatt Regency resort. Pumps in the council's waste network were misbehaving. Alarms were being suppressed. SCADA logs that should have shown faults showed nothing.
A radio and a grudge
The cause turned out to be Vitek Boden, a contractor who had helped install the council's wastewater SCADA system on behalf of the supplier Hunter Watertech. Boden had applied for a permanent job with the council, been turned down, and decided to retaliate. He kept his employer's laptop and two-way radio, both of which still spoke the proprietary protocols used by the network's remote pump stations.
Over a period of roughly two months and at least forty-six separate intrusions, Boden drove around the shire with his equipment in the back of his car, issuing commands that overrode pump set points and disabled alarms. The result was around 800,000 liters of raw sewage discharged into local waterways before he was arrested in his vehicle at a roadside stop.
A case study with a long half-life
Boden's prosecution was one of the first in the world for unauthorized control of an industrial system. Two decades on, the Maroochy case is still cited in industrial-cybersecurity coursework as a primary example of how trivially physical consequences can follow from insider access to a poorly-segmented SCADA network.
What the chronicle remembers
Maroochy Shire is the oldest publicly documented OT incident with real-world environmental impact. Every later argument for ICS network segmentation, revoked-credential discipline, and contractor offboarding controls is, in some sense, arguing against a future Vitek Boden.