A cybersecurity incident disrupted the irrigation system of the Turia Garden on September 16, when unusual behavior was detected and the containment protocolAccording to municipal sources, the intrusion originated from Russian IP addresses and was quickly addressed by technicians.
The Valencia City Council specifies that the anomaly was resolved after isolate the equipment committed, without affecting other services of the corporation. The system, with ten years operating and dependent on the Autonomous Agency of Parks and Gardens, presented a security leak which allowed unauthorized access.
What happened and how it was detected
The alert was raised when a abnormal operation of automated irrigation in the old channel of the Turia. In the section VIAt the height of the Serranos Towers, the sprinklers remained on continuously and uncoordinatedly for several minutes.
That behavior caused occasional puddles in some lanes of the area, which led to an immediate review of the system's telemetry. The segmentation of irrigation in 14 independent sections limited the scope of the incident to a single sector of the park.
After the initial analysis, the technicians confirmed that the intrusion originated from IP addresses located in Russia. Although there were no further impacts, the priority was reset secure parameters and cut off any possibility of spread to other teams.
Technical response and irrigation status
The first measure consisted of isolate the drivers involved. Automatic irrigation was then deactivated in the affected section and switched to a manual operation to ensure smooth delivery while the configuration was thoroughly reviewed.
Municipal sources indicate that the rest of the Turia Garden and the other City Hall services were operating normally. The incident was resolved and enhanced surveillance of the irrigation network is being maintained to detect any replica.
- A was applied strict segmentation to limit the impact to section VI.
- Temporary deactivation of automatic irrigation in the affected area and supervised manual activations.
- Credentials review, patches and accesses of the system with a decade of service.
- search for a specialized company to audit and protect irrigation infrastructure.
Where the intrusion came from and what is being investigated
Unauthorized access was channeled through Russian IPs, according to the initial investigation. This source data does not in itself constitute a definitive attribution, but it guides the lines of analysis that are being followed to understand the techniques and the vector used.
In the technical area it is considered that the episode could fit into a European context attacks on infrastructure, although there is no confirmation of direct links so far. It has also been hypothesized that the real target could be more sensitive—such as the red of drinking water— and that the disruption to irrigation was a side effect or a mistake by the attackers.
Municipal cybersecurity: status and improvements
Valencia has a Cybersecurity Master Plan approved in 2021 and a Cybersecurity Office awarded in 2023 to coordinate measures across all municipal services. This incident reinforces the need to accelerate controls and audits in critical systems.
The Sindicatura de Comptes, in a report 2024, described the level of municipal protection as "insufficient," despite partial progress. Among the recommendations were separate functions security and systems exploitation, in addition to completing ongoing projects to increase compliance with the National Security Scheme.
Parks and Gardens is already working on hiring a supplier to reinforce the cyber resilience Irrigation. The experience of these days points to benchmark practices: effective segmentation, logging and monitoring continuous, updating of veteran equipment and periodic intrusion testing.
Beyond irrigation, the council is studying extending these improvements to other areas. urban infrastructures (lighting, traffic, communications), so that a localized incident does not lead to disruptions of greater draft.
The episode of September 16th made it clear that a punctual vulnerability In a veteran system it can generate an operational problem, but also that segmentation and rapid reaction contained the impactWith irrigation back to normal —and the affected section under temporary manual control—, the focus is now on closing the hole, strengthening the protocols and fine-tune surveillance so that Valencia's main green lung maintains its pace without any problems.