Internet-Exposed PLCs in Water Utilities Under Active Attack
Attackers are exploiting programmable logic controllers (PLCs) in water and wastewater systems that are directly accessible from the public internet — a fundamental security misconfiguration that should never exist in critical infrastructure. By gaining access to these exposed devices, threat actors were able to change passwords, alter IP addresses, and disrupt operations across more than 30 Minnesota community water systems. This incident highlights that operational technology (OT) environments require strict isolation from the internet, as these systems were designed for reliability, not cyber resilience. The consequences of compromised water infrastructure extend beyond IT disruption to direct public health and safety risks, making this a critical national security concern.
Tactical Insight
Immediate actions
- Audit all OT/ICS assets and immediately remove any PLCs or SCADA components with direct internet-facing exposure.
- Change all default credentials on PLCs and enforce strong, unique passwords for every operational technology device.
- Apply available firmware and software patches to all internet-connected industrial control systems.
Long-term improvements
- Implement strict network segmentation using firewalls and DMZs to isolate OT networks from IT networks and the public internet.
- Deploy a jump server or secure remote access solution (e.g., VPN with MFA) as the only permitted pathway for remote OT administration.
- Maintain a continuously updated asset inventory of all OT/ICS devices, including firmware versions and network exposure status.
Detection measures
- Enable logging and real-time alerting on all PLC configuration changes, login attempts, and network anomalies.
- Deploy an OT-aware intrusion detection system (IDS) capable of monitoring industrial protocols (e.g., Modbus, DNP3).
- Conduct regular vulnerability scans and penetration tests specifically targeting OT/ICS assets.