Public water systems face OT attacks through exposed HMI and PLC devices

At a glance

What this is: This is an analysis of coordinated attacks on public water systems that exploited internet-exposed OT devices and disrupted monitoring and control.

Why it matters: It matters because utilities and other critical infrastructure teams need governance that protects OT availability and safety even after initial access is lost.

By the numbers:

• More than 30 community water systems in Minnesota were targeted in a coordinated cyberattack, with additional incidents reported across at least seven U.S. states.

👉 Read ColorTokens' analysis of public water system attacks and OT containment

Context

Public water systems are part of critical infrastructure, so a successful attack is not just a data event but a safety and continuity issue. In this case, the primary OT security gap was internet-exposed control devices that allowed remote tampering with plant operations, a pattern that also creates a legitimate identity and access problem around who or what can reach industrial systems.

The article’s central point is that preventive controls alone are not enough when attackers can reach exposed HMIs and PLCs. For IAM and security teams, the relevance is the intersection of remote access governance, privileged device access, and operational resilience, because OT environments need segmentation and access control that still hold after the first control fails.

Key questions

Q: What breaks when OT devices are exposed to the internet?

A: Internet exposure turns HMIs and PLCs into reachable control points rather than protected field assets. Once attackers can authenticate or exploit them, they can alter process settings, change credentials, and disrupt monitoring. The practical failure is not only compromise of a device, but loss of trust in the control plane that keeps physical operations stable.

Q: Why does microsegmentation matter in industrial control environments?

A: Microsegmentation matters because it limits how far an attacker can move after the first foothold. In OT, that containment is often the difference between a single compromised interface and a plant-wide operational event. It also helps preserve essential functions while other controls are investigated or restored.

Q: How can organisations tell whether OT access controls are actually working?

A: Look for evidence that access is issued only on demand, expires automatically, and can be tied to a named user, task, and session record. If audits still require manual reconstruction, the control is not working at the governance level. Strong OT access management produces verifiable traces, not just fewer help desk tickets.

Q: Who is accountable when a water utility loses control of OT systems?

A: Accountability usually spans operations, security, and utility leadership because the impact is physical as well as cyber. The useful question is whether the organisation can prove who approved remote access, who owns privileged device credentials, and who is responsible for containment when normal control paths fail.

Technical breakdown

Internet-exposed HMI and PLC devices

Human Machine Interfaces and Programmable Logic Controllers sit close to physical process control, so exposure of these devices creates direct operational risk. If attackers can reach them from the internet, they can manipulate settings, alter credentials, and disrupt visibility into the process. The issue is not only weak authentication, but also excessive exposure of devices that were never meant to be broadly reachable. In OT environments, device reachability is itself a security decision, and it must be governed as tightly as privileged access.

Practical implication: reduce direct internet reachability for OT devices and isolate them behind controlled access paths.

Why microsegmentation matters in OT network security

Microsegmentation limits lateral movement by enforcing traffic controls between assets, zones, and roles. In OT, that matters because once an attacker reaches one device, flat network design can let them move to adjacent systems that support monitoring, control, or engineering. Segmentation does not replace authentication, but it reduces blast radius and preserves operational functions when perimeter controls fail. The article’s focus on both agent-based and agentless enforcement reflects a common OT reality: not every asset can host software agents.

Practical implication: segment OT traffic so a single compromised device cannot reach the rest of the control environment.

Identity and access control for industrial operations

OT security is often discussed as a network problem, but identity still matters because attackers in this incident altered passwords and used access paths to change device behaviour. That creates a governance requirement for administrative access, remote maintenance, and device-level credentials. Where human operators, service accounts, or vendor access touch OT systems, authentication must be narrowly scoped and monitored. This is where IAM and PAM intersect with resilience: access control needs to reflect physical process risk, not just IT convenience.

Practical implication: tighten privileged access to OT systems and review every account that can modify device settings.

Threat narrative

Attacker objective: The attackers appear to have aimed to disrupt water-system operations by taking control of OT devices and degrading monitoring and control capability.

1. Entry occurred through internet-exposed HMI and PLC devices in OT environments that were reachable from outside the network.
2. Escalation followed when attackers altered IP addresses and passwords, giving them stronger control over monitoring and system behaviour.
3. Impact came when wastewater monitoring and control were disrupted, forcing some utilities to switch to manual operations.

NHI Mgmt Group analysis

Exposed OT devices create a control-plane problem, not just a perimeter problem. When HMIs and PLCs are reachable from the internet, the real failure is governance over device exposure and remote management paths. Preventive filtering helps, but the core question is whether process-control assets are ever allowed to sit inside a reachable trust boundary. Practitioner conclusion: treat reachability as an access decision tied to operational risk.

OT microsegmentation is a resilience control because it preserves function after compromise. The article correctly points to lateral movement as the danger that turns a local intrusion into a plant-wide event. In critical infrastructure, containment is the control that keeps one exposed asset from becoming an outage. Practitioner conclusion: design zones around process dependencies, not around organizational charts.

Industrial identity needs tighter governance around privileged device access. The attackers changed passwords, which shows how quickly device-level identity can be used to reshape control of a physical process. That intersection of IAM, PAM, and OT operations is often under-governed because maintenance access is treated as exceptional. Practitioner conclusion: apply lifecycle control, approval, and logging to every account that can alter OT device state.

Process safety depends on assuming initial breach will happen. The article’s breach-ready framing is directionally correct for critical infrastructure because AI-assisted reconnaissance and exposed-service discovery compress attacker timelines. That does not make prevention irrelevant, but it does make detection and containment the decisive controls. Practitioner conclusion: align OT security with zero trust and safety continuity, not with perimeter-only assumptions.

What this signals

OT containment is becoming the practical line between disruption and crisis. Water and other critical infrastructure operators should assume that exposed services, vendor access, and device credentials will eventually be probed, then design the network so one compromised asset cannot alter process integrity across the estate. The control question is less about perfect prevention and more about whether the plant can keep operating safely when entry occurs.

Identity governance now reaches into operational technology. Where device credentials, remote maintenance accounts, and operator privileges can change process state, IAM and PAM become safety controls as much as access controls. That means reviewing privileged paths, logging state-changing actions, and tying access to operational necessity rather than historical convenience.

Containment-first architectures are the most defensible model for critical infrastructure. The more connected OT becomes, the more valuable segmented zones, brokered access, and controlled fallback procedures become. That logic aligns with zero trust principles and with the broader shift toward surviving intrusions rather than assuming they can always be stopped upfront.

For practitioners

• Remove direct internet exposure from OT control devices Inventory HMIs, PLCs, engineering workstations, and remote maintenance paths, then place them behind controlled jump hosts, VPNs, or equivalent access brokers with strict allowlists. The goal is to ensure no control device is reachable without an explicit access decision.
• Segment OT zones to block lateral movement Define traffic policies between HMIs, PLCs, historians, SCADA servers, and administrative systems so a compromise in one zone cannot propagate. Use microsegmentation or equivalent network controls to separate process control from enterprise traffic.
• Harden privileged access to device credentials Review every account that can change passwords, IP settings, or control logic on OT assets. Require named administrative access, multi-factor authentication where feasible, and logging for all state-changing actions.
• Build manual-operating procedures for control loss Prepare operators to switch safely to manual control when monitoring or remote command channels are disrupted. Test these procedures with plant teams so containment plans work under outage conditions, not only in tabletop discussions.

Key takeaways

• The breach shows that exposed OT devices can be used to alter real-world operations, not just steal data.
• The impact was operational disruption across multiple water systems, which makes containment the decisive control gap.
• Removing direct exposure and enforcing segmentation around OT devices would have materially reduced the attacker’s room to move.

Key terms

• Operational Technology: Operational Technology is the hardware and software that monitors or controls physical processes such as manufacturing lines, utilities, and transportation systems. Unlike standard IT, OT prioritises uptime and safety, so identity controls must be precise enough to reduce risk without interrupting essential operations.
• Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.
• HMI: A Human Machine Interface is the operator-facing system used to monitor and control industrial processes. Because it often sits between people and process control, an exposed HMI can become a high-value target for attackers seeking to alter settings or disrupt visibility.
• PLC: A Programmable Logic Controller is an industrial device that executes control logic for physical equipment and processes. PLCs are often deeply trusted inside OT environments, so compromise or misuse can quickly affect how machinery behaves in the real world.

What's in the full article

ColorTokens' full article covers the operational detail this post intentionally leaves for the source:

• How the vendor maps IT and OT traffic to support microsegmentation decisions in mixed environments
• The enforcement options described for agent-based and agentless OT assets, including PLCs and actuators
• The article's device-level examples for HMI, SCADA, historian, and engineering workstation segmentation
• The vendor's explanation of how its controls are positioned for water utilities and other critical infrastructure operators

👉 ColorTokens' full post covers the attack path, device exposure, and OT segmentation approach.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It is designed for practitioners who need to connect identity control to broader security and resilience programmes.