Theft of Operational Information
Description
Adversaries may steal operational information on a production environment as a direct mission outcome for personal gain or to inform future operations. This information may include design documents, schedules, rotational data, or similar artifacts that provide insight on operations. In the Bowman Dam incident, adversaries probed systems for operational data. (Citation: Mark Thompson March 2016) (Citation: Danny Yadron December 2015)
Mapped SPARTA techniques
1 techniques
T0882 'Theft of Operational Information' is in MITRE ICS impact tactic and addresses adversary theft of operational information from production environments — exact title-and-concept match for SPARTA IMP-0006 'Theft' (steal mission-critical data). Tactic and activity align directly. Notable: this is a tactic-aligned high anchor in MITRE ICS where MITRE Enterprise had cross-tactic moderate to T1041 — ICS uniquely models data theft as an impact-tactic outcome rather than separating it from the exfiltration mechanism.
Cite as SafeMode Space, mitre-attack-ics T0882.