INDUSTRY FACT FILE · CHEMICALS, FERTILIZERS & PROCESS INDUSTRIES

Five New Case Studies in Chemical and Fertilizer Plant Security

Original 2026 case studies, each written as a blog post, showing how current threats play out in chemical, fertilizer, agrochemical and process companies and how Codec Networks services break the attack chain.

In this document 1.  About these case studies 2.  Case Study 1: The Set-point Nobody Changed 3.  Case Study 2: The Fertilizer Plant That Couldn't Claim Its Subsidy 4.  Case Study 3: The Formulation That Left With the Contractor 5.  Case Study 4: The Dealer Portal Payment Diversion 6.  Case Study 5: The Turnaround USB on the DCS Network

These five case studies were written for this document set and have not been published elsewhere. Each is a composite scenario combining attack techniques and control failures widely observed in process industries with the obligations that apply in India as of October 2026—in particular CERT-In's Directions and audit guidelines, safety-regulator expectations, the Fertiliser (Control) Order and DBT scheme, SEBI disclosure for listed companies and DPDP.

Important disclosure The organisations described are fictional and the scenarios are illustrative. They are not accounts of real incidents, and they are not Codec Networks client engagements or claims of achieved outcomes. Their value lies in showing how connected weaknesses form an attack chain, which controls break it, and which services test those controls.

Case study	Organisation type	Core threat	Regulatory lens	Primary bundles
1. The Set-point Nobody Changed	Specialty chemical plant	Vendor remote access reaching the DCS	Factories Act; CERT-In; IEC 61511	B9, B1, B7
2. The Fertilizer Plant That Couldn't Claim Its Subsidy	Fertilizer producer	Ransomware on ERP and integration servers	DBT and FCO; CERT-In; SEBI LODR	B3, B7, B2
3. The Formulation That Left With the Contractor	Agrochemical company	Contractor theft of formulations	Contracts; Insecticides Act; DPDP	B3, B6, B8
4. The Dealer Portal Payment Diversion	Paints and coatings company	Business email compromise through the dealer network	DPDP; CERT-In; banking	B2, B10, B7
5. The Turnaround USB on the DCS Network	Bulk chemical plant	Malware introduced by contractor media	Factories Act; CERT-In; contracts	B9, B3, B7

The reactor was heading out of limits. Nobody in the control room had touched it.

At a glance
Organisation	A specialty chemical company (“Specco A”) running exothermic batch reactors
Threat	A phished DCS vendor account used through a standing VPN to alter reactor set-points from an engineering workstation
Why it is new	Vendor access is the most common unmonitored path to control and safety systems
Codec Networks services	Vendor access programme, OT and SIS assessment, OT monitoring (Bundles B9, B1, B7)

The scenario

Specco A's DCS vendor maintained a permanent VPN for support, using an account shared by several engineers. One of them was phished.

The attackers reached an engineering workstation that could change both control and safety configurations, and raised reactor temperature and pressure set-points in small steps over two shifts.

The safety instrumented system tripped the unit before a release. Investigation found months of unrecorded vendor sessions and a safety system that had been reachable from the same workstation.

Figure 8: Illustrative attack path for Case Study 1 and the controls that break it.

What went wrong

• Standing VPN with a shared vendor account and no MFA.
• Engineering workstation able to reach both DCS and SIS.
• Set-point and logic changes were not monitored.
• No record of remote sessions.

The impact

Specco A lost a week of production, conducted a safety investigation, reported the incident and re-tendered vendor support with security requirements.

The regulatory lens

• Factories Act and MSIHC Rules: process upset investigated as a safety event.
• CERT-In Directions: incident reported within six hours.
• IEC 61511 and IEC 62443: SIS isolation and access requirements the plant did not meet.

How Codec Networks would help

Need	Codec Networks response	Bundle
Control vendors	Brokered, time-bound access with MFA and recording; vendor assessment	B9
Protect the SIS	OT and SIS assessment, engineering workstation separation	B1
Watch the plant	OT monitoring of remote sessions and set-point changes	B7

Key lessons Replace standing VPNs with brokered access. Separate safety engineering from control engineering. Monitor set-point and logic changes. Record every vendor session.

The plant made urea all week. The company couldn't prove it had sold a bag.

At a glance
Organisation	A listed fertilizer producer (“Fertco B”) with two plants and 20,000 retail points
Threat	Ransomware encrypting ERP, the DBT integration layer and file servers at the start of the kharif season
Why it is new	Fertilizer revenue depends on reconciling PoS sales with ERP for subsidy claims
Codec Networks services	Segmentation and recovery, SOC, integration security (Bundles B3, B7, B2)

The scenario

Attackers entered through a phished finance user and, over three weeks, took domain control unnoticed. On a Sunday they encrypted ERP, the integration servers that reconcile PoS sales with the Department of Fertilizers' systems, and the backup server on the same network.

The plants kept producing, but dispatch slowed to manual paperwork, PoS sales could not be reconciled and subsidy claims stalled at the peak of the season.

Dealers ran short of stock and credit; Fertco B's working capital drained; and it took five weeks of rebuilding and manual reconciliation before claims flowed again.

Figure 9: Illustrative attack path for Case Study 2 and the controls that break it.

What went wrong

• ERP, integration and backup servers shared one network and one set of credentials.
• No manual dispatch and reconciliation playbook.
• EDR alerts were not monitored 24x7.
• No tested restore of the integration layer.

The impact

Fertco B faced a seasonal supply shortfall, a working-capital squeeze, dealer disputes, a quarterly disclosure and engagement with the Department of Fertilizers.

The regulatory lens

• Fertiliser (Control) Order and DBT: distribution, pricing and subsidy obligations tied to ERP and PoS data.
• CERT-In Directions: incident reported within six hours.
• SEBI LODR: cyber incident disclosed in the quarterly corporate governance report.

How Codec Networks would help

Need	Codec Networks response	Bundle
Separate and recover	Segmentation of ERP, integration and plant networks; immutable backups; tested restores	B3
Detect early	24x7 SOC with EDR monitoring and threat hunting	B7
Harden the integrations	Integration and portal security testing, continuity planning	B2

Key lessons Treat subsidy integrations as revenue-critical systems. Keep backups off the domain and test restores. Plan manual dispatch and reconciliation. Monitor endpoints around the clock.

The rival product matched to the decimal point.

At a glance
Organisation	An agrochemical formulator (“Agroco C”) with proprietary formulations and regulatory dossiers
Threat	A contract chemist exporting recipes, process parameters and dossier data to personal cloud storage over several months
Why it is new	Formulations are the company's value and are rarely monitored
Codec Networks services	Data classification and DLP, offboarding controls, forensics (Bundles B3, B6, B8)

The scenario

Agroco C engaged a contract chemist with full access to its formulation system and shared drives. Over months, the contractor exported recipes, process parameters and regulatory dossiers to a personal cloud account.

Access remained active for weeks after the contract ended. A competitor then launched an equivalent product at a lower price.

Agroco C lost key distributors and pursued legal action with little evidence of what had been taken or when.

Figure 10: Illustrative attack path for Case Study 3 and the controls that break it.

What went wrong

• Formulation data was not classified or access-limited by need.
• Bulk exports and personal cloud uploads were not blocked or monitored.
• Contractor offboarding did not remove access.
• No forensic readiness to prove the theft.

The impact

Agroco C lost revenue and distributors, faced a weak legal position and rebuilt its data governance and contractor controls.

The regulatory lens

• Contracts and IP law: confidentiality obligations and the need for evidence.
• Insecticides Act and CIB&RC: integrity of registration dossiers.
• DPDP: employee and dealer data within the exported files.

How Codec Networks would help

Need	Codec Networks response	Bundle
Protect the crown jewels	Data classification, DLP, formulation system and LIMS access reviews	B3
Govern the data	DPDP programme and data-handling controls for contractors	B6
Prove it	Forensic readiness and investigation support	B8

Key lessons Classify and restrict formulation data. Block and monitor personal cloud uploads. Remove contractor access on the last day. Be ready to investigate and prove.

Dealers paid on time. The money went somewhere else.

At a glance
Organisation	A paints company (“Paintco D”) with 5,000 dealers paying through a portal and invoices
Threat	A phished sales manager's mailbox used to send revised bank details to dealers during the peak season
Why it is new	Dealer networks move large seasonal payments on trust
Codec Networks services	Portal and payment testing, BEC simulation, monitoring (Bundles B2, B10, B7)

The scenario

Attackers phished a regional sales manager and watched the mailbox for weeks. At the start of the festive season they sent dealers 'updated' bank details on genuine-looking invoices.

Dozens of dealers paid into the attackers' account before reconciliation revealed the gap. The portal itself had no alert for bank-detail changes and no MFA.

Paintco D recovered little, faced dealer disputes and filed police complaints.

Figure 11: Illustrative attack path for Case Study 4 and the controls that break it.

What went wrong

• No MFA on email or the dealer portal.
• No verification of bank-detail changes.
• No monitoring of mailbox rules or invoice changes.
• Finance and dealer teams were untrained on BEC.

The impact

Paintco D lost seasonal revenue, strained dealer relationships and rebuilt its payment verification and portal security.

The regulatory lens

• DPDP: dealer data exposed from the mailbox.
• CERT-In Directions: incident reported within six hours.
• Banking and police processes: recovery attempts and complaints.

How Codec Networks would help

Need	Codec Networks response	Bundle
Test the portal	Dealer portal and payment flow security testing, MFA	B2
Train and rehearse	BEC simulation and finance and dealer team training	B10
Watch for abuse	Monitoring of mailbox rules, invoice and master-data changes	B7

Key lessons Enforce MFA on email and portals. Verify every bank-detail change by call-back. Monitor mailbox rules and invoice changes. Train finance and dealer teams.

Three hundred contractors came for the turnaround. One brought malware.

At a glance
Organisation	A chlor-alkali producer (“Bulkco E”) during a planned turnaround
Threat	Self-spreading malware on a contractor's USB drive reaching the historian and operator stations
Why it is new	Turnarounds bring uncontrolled devices and media into plant networks
Codec Networks services	Third-party access programme, segmentation, OT monitoring (Bundles B9, B3, B7)

The scenario

During a turnaround, a contractor used a USB drive to move configuration files between a personal laptop and a DCS engineering station.

The drive carried self-spreading malware that reached the historian and several operator stations. Screens froze and the unit was run manually at reduced rates.

Cleaning the plant network extended the turnaround by a week and raised questions from the safety regulator about control-room availability.

Figure 12: Illustrative attack path for Case Study 5 and the controls that break it.

What went wrong

• No scanning kiosk or removable-media policy enforced.
• Contractor laptops connected directly to plant networks.
• OT endpoints lacked protection and monitoring.
• No segmented temporary access for turnaround work.

The impact

Bulkco E faced turnaround delays, cost overruns, a regulator query and a review of contractor security requirements.

The regulatory lens

• Factories Act: safe operation during maintenance.
• CERT-In Directions: incident reported within six hours.
• Contracts: contractor security obligations.

How Codec Networks would help

Need	Codec Networks response	Bundle
Control contractors	Third-party access programme, device scanning, media kiosks	B9
Segment access	Temporary, segmented turnaround networks	B3
Watch OT	OT endpoint and network monitoring	B7

Key lessons Control every USB drive and contractor device. Give contractors segmented access. Protect and monitor OT endpoints. Put security into turnaround contracts.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com