Exposed PLCs in water systems create direct operator lockout risk

At a glance

What this is: Censys characterises exposed PLCs in the water and wastewater sector and shows that operator lockout and device disruption remain realistic outcomes when internet-facing OT is left reachable.

Why it matters: For IAM and OT security teams, the issue is not just exposure but who can authenticate to critical controllers, how remote access is brokered, and whether undocumented connections bypass governance.

By the numbers:

• Censys identified 4,148 internet-exposed hosts that respond to EtherNet/IP and self-identify as Rockwell Automation/Allen-Bradley.
• Censys identified 4,117 internet-exposed hosts that fingerprint as Siemens SIMATIC S7-1200.
• Censys identified 2,072 internet-exposed hosts fingerprinting as Schneider Electric hardware.

Context

Internet-exposed PLCs are industrial control devices that should not be directly reachable from the public internet. In water and wastewater environments, exposure becomes an access-governance problem as much as an operations problem, because remote control paths can be abused to alter device settings, disrupt availability, or block legitimate operator access.

CISA’s warning matters because the blind spot is often not the primary controller but the surrounding access path, including cellular modems, undocumented vendor links, and other exceptions that never entered the asset inventory. That is the same governance gap seen when OT and identity controls do not share one authoritative picture of who can reach what.

Key questions

Q: What breaks when PLCs are exposed directly to the Internet?

A: Direct exposure removes the safety margin that OT segmentation is supposed to provide. Attackers can probe controllers, identify common ports, and interact with engineering interfaces without first compromising an internal foothold. Once that happens, remote access, project-file theft, and logic manipulation become much easier to automate and hide.

Q: Why do undocumented cellular modems create so much OT risk?

A: They create hidden remote access paths that often sit outside normal discovery, change control, and review processes. If a modem can bridge into a PLC but is not in the inventory, the organisation cannot govern it, monitor it, or revoke it reliably. That makes the modem an unmanaged access channel rather than a harmless connectivity accessory.

Q: What signs suggest PLC access governance is failing?

A: Common signals include externally reachable controllers, unexpected modem presence, default credentials, and remote paths that no one can name with confidence. If operations teams cannot say which paths are approved, who owns them, and how they are disabled during an incident, the access model is already failing.

Q: How should operators respond when PLC access is already compromised?

A: Containment should focus on severing unauthorised remote reachability, preserving the controller state, and restoring only through validated access paths. Operators should avoid assuming the device can be reached or repaired normally until the remote path is confirmed clean. Recovery must be coordinated with safety and operations so the plant does not worsen the disruption while trying to fix it.

Technical breakdown

Why direct PLC exposure creates a control-plane problem

A PLC exposed to the internet is not just an endpoint risk; it is a control-plane risk because the device itself may accept configuration, password, or network-setting changes from unauthorised remote sources. In OT, that collapses the normal trust boundary between monitoring, control, and administration. Once the controller is reachable, the attacker does not need lateral movement inside the plant first. They can target the management surface directly, which is why simple perimeter scanning is not enough to prove safety. See the OT and ICS Identity and Access Guide.

Practical implication: Treat every externally reachable PLC as a privileged access exception that must be removed or mediated.

Why cellular modems defeat ordinary asset discovery

Cellular modems often sit outside traditional network discovery because they are provisioned by operators, vendors, or integrators and then forgotten. That makes them a hidden ingress path into OT, especially when the modem is attached to a controller or remote maintenance link. From a governance perspective, the device is not just undocumented infrastructure. It is an unmanaged access route with its own trust relationship, which means the real exposure surface can be wider than the scanned OT network. See the Edge Device Security Guide.

Practical implication: Inventory every modem-backed access path as part of the control environment, not as a side connection.

How PLC credential abuse turns into operational disruption

In this attack pattern, password modification is a high-impact control action because it blocks operators from restoring or supervising the device. Changing the controller’s IP address further severs legitimate reachability and can force manual operations while the site stabilises. That is why the incident is better understood as governance failure over remote administration and recovery, not simply as unauthorised login. The attacker is using the PLC’s own management functions against the operator. See the OT Incident Response Guide.

Practical implication: Protect PLC administrative functions with tightly governed remote access and recovery procedures.

Threat narrative

Attacker objective: The objective is to gain control of exposed industrial devices in a way that disrupts operations and denies legitimate operators access.

1. Entry occurs through internet-exposed PLCs or undocumented modem-mediated remote access paths rather than through the plant perimeter.
2. Credential abuse follows when the actor changes passwords or otherwise seizes controller administration, cutting off normal operator access.
3. Escalation occurs when the attacker changes IP addressing or control settings, disrupting supervision and forcing manual intervention.
4. Impact is operational disruption, including sustained manual operations and boil-water notices where the plant can no longer be run normally.

Breaches seen in the wild

• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Internet-facing PLCs create a privileged access problem, not just an exposure problem. Once a controller is reachable from the public internet, the issue becomes who can administer it, what changes are allowed, and how that access is revoked. In OT, the management plane often sits outside normal identity governance, so the attacker only needs one weak path to reach a high-impact function. The practitioner conclusion is to treat remote PLC administration as privileged access that must be mediated, logged, and tightly bounded.

Undocumented modem links are a governance failure in the access inventory. If a cellular modem can reach a PLC but is missing from routine scans, then the organisation does not actually know its remote access estate. That is an identity and access visibility issue as much as a network issue, because access cannot be governed if the path is invisible. The practitioner conclusion is to fold every remote maintenance path into the same inventory and review model as any other privileged route.

OT recovery assumptions break when the attacker can rewrite the device path. Changing passwords and IP addresses does more than interrupt service. It invalidates the operator’s expectation that normal restoration procedures will still work during an incident. That is a distinct control gap: recovery planning that assumes the device remains addressable and recoverable. The practitioner conclusion is to validate restoration under hostile conditions, not only under outage conditions.

Water-sector exposure is a systems problem, not a single-vendor problem. The presence of Rockwell Automation, Siemens, and Schneider Electric hardware in the exposure data shows that the same governance challenge can appear across different OT ecosystems. The common denominator is unmanaged remote reachability, not one product line. The practitioner conclusion is to standardise access policy, segmentation, and exception handling across the entire OT estate, including vendor and integrator connections.

What this signals

Remote PLC exposure is now an access-governance metric, not just an attack-surface metric. For water and wastewater operators, the question is whether every externally reachable controller has a named owner, approved access path, and documented recovery route. If not, the exposure problem has already become a privilege problem.

Undocumented modem paths are the strongest indicator that the OT access model is incomplete. Once a site relies on connections outside routine scanning and review, the organisation loses the ability to enforce least privilege or to prove who can reach the controller at any given time.

OT incident response for this sector has to assume access denial, not just downtime. When a PLC can be readdressed or recredentialed by an attacker, the response plan must prioritise validated restoration paths and operator continuity before broader network remediation.

For practitioners

• Remove direct internet reachability for PLCs Route remote administration through a controlled VPN or gateway, and block direct public access to controller management interfaces.
• Inventory every cellular modem and vendor link Capture operator-installed, vendor-installed, and integrator-installed modem paths in the same asset and access inventory as the PLCs they serve.
• Enforce unique credentials and password recovery procedures Replace default passwords, restrict who can modify controller credentials, and document recovery steps for controller lockout scenarios.
• Allowlist approved engineering sources Permit remote access only from known engineering laptops or other approved OT assets so controller access remains attributable and limited.

Key takeaways

• Internet-facing PLCs in the water sector create a privilege and recovery problem, not only an exposure problem.
• CISA’s warning is reinforced by the exposure picture, which shows thousands of externally reachable controllers across major industrial vendors.
• The practical control failure is unmanaged remote access, especially where cellular modems and vendor links sit outside the normal inventory and response model.

Related NHI Mgmt Group resources: OT and ICS Identity and Access Guide · Edge Device Security Guide · OT Incident Response Guide · OT Security Guide

Key terms

• Programmable Logic Controller: A Programmable Logic Controller is an industrial device that executes control logic for machinery and processes. PLCs are often trusted to run continuously, so unauthorized access can alter physical behaviour quickly. In modern SCADA governance, PLC access must be tightly scoped and traceable.
• Operational Technology: Operational Technology is the hardware and software that monitors or controls physical processes such as manufacturing lines, utilities, and transportation systems. Unlike standard IT, OT prioritises uptime and safety, so identity controls must be precise enough to reduce risk without interrupting essential operations.
• Remote Access Gateway: A remote access gateway is an externally reachable control point that brokers user or system access into internal resources. In IAM terms, it becomes a critical identity surface because it mediates authentication, policy enforcement, and the visibility of protected applications.
• Modem-Mediated Access: Modem-mediated access is a remote connectivity path that uses a cellular or other external modem to reach equipment without traversing the organisation’s normal network controls. These links are often overlooked in inventories, which makes them a common source of hidden exposure and unmanaged privilege.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and workload identity in a way that helps teams connect access control to operational risk. It is a useful baseline for practitioners who need to govern privileged access across mixed identity estates.