Cybersecurity dataset of water distribution plant communications under MQTT topic hijacking attacks

This dataset captures MQTT traffic from a water distribution control system under topic hijacking attacks, where the communication routing is maliciously altered without modifying message payloads. The attack consists of manipulating the plant identifier within MQTT topics of the form: optimizacion/planta_nivelN/parametros optimizacion/planta_nivelN/consigna During attack campaigns, messages originally addressed to a given plant are redirected to a different plant (e.g., plant 1 ↔ plant 2), causing control commands and process measurements to be delivered to unintended recipients. This results in logical inconsistencies between the physical process and the supervisory control layer. Each affected message includes the field nuevo_topic, enabling traceability of the redirection. Campaign durations and cooldown periods are variable and follow a probabilistic model, simulating realistic attacker behavior. Acknowledgements This activity is carried out in execution of the Strategic Project "Critical infrastructures cybersecure through intelligent modeling of attacks, vulnerabilities and increased security of their IoT devices for the water supply sector" (C061/23), the result of a collaboration agreement signed between the National Institute of Cybersecurity (INCIBE) and the University of A Coruña. This initiative is carried out within the framework of the funds of the Recovery, Transformation and Resilience Plan, financed by the European Union (Next Generation), the project of the Government of Spain that outlines the roadmap for the modernization of the Spanish economy, the recovery of economic growth and job creation, for the solid, inclusive and resilient economic reconstruction after the COVID19 crisis, and to respond to the challenges of the next decade.