Public water systems face OT attacks through exposed HMI and PLC devices

At a glance

What this is: ColorTokens says public water systems were targeted through exposed HMI and PLC devices, with attackers changing device settings and disrupting OT monitoring and control.

Why it matters: This matters because OT environments cannot rely on perimeter defence alone when exposed control devices can be reached directly and used to disrupt critical operations.

Context

Operational technology security fails when internet-reachable control devices sit outside the same governance model as the rest of the environment. In this case, exposed HMIs and PLCs created a direct path into wastewater monitoring and control, which is why perimeter-only thinking breaks down for critical infrastructure.

For IAM and PAM teams, the identity question is not limited to humans. Device access, administrative credentials, and remote control channels for HMIs and PLCs need the same ownership, scope, and containment discipline as other privileged access paths. The article describes a pattern that is increasingly typical in OT incidents: once the edge is exposed, compromise can turn into operational disruption very quickly.

Key questions

Q: What breaks when PLCs are exposed directly to the Internet?

A: Direct exposure removes the safety margin that OT segmentation is supposed to provide. Attackers can probe controllers, identify common ports, and interact with engineering interfaces without first compromising an internal foothold. Once that happens, remote access, project-file theft, and logic manipulation become much easier to automate and hide.

Q: Why do exposed OT devices create such high operational risk?

A: Exposed OT devices create high risk because control systems are designed to be stable, trusted, and continuously reachable. If an attacker can change credentials, routing, or device settings, the organisation can lose both control and situational awareness. That combination is especially dangerous in water systems, where service disruption can affect safety as well as uptime.

Q: What are the signs that OT segmentation is failing in practice?

A: Look for maintenance paths that can reach more than one zone, credentials that remain usable after the job ends, and limited visibility into what the session actually touched. Those are signs that segmentation is still being enforced by assumption rather than by policy.

Q: How should utilities govern privileged access to OT control devices?

A: Utilities should treat access to HMIs, PLCs, historians, and SCADA servers as privileged access and assign clear ownership for each path. Access should be approved, logged, and limited to the systems that truly need it. The goal is to make device administration auditable and to prevent a single credential from becoming broad operational control.

Technical breakdown

How exposed HMIs and PLCs become an OT entry path

Human Machine Interfaces and Programmable Logic Controllers often sit at the edge of operational environments because they need to communicate with both operators and plant processes. When these devices are internet-exposed, they become direct targets rather than protected internal assets. Attackers do not need sophisticated malware if they can reach configuration surfaces, remote management functions, or weakly protected control channels. In OT, a single reachable device can provide enough leverage to interfere with physical processes, especially where segmentation is weak and remote administration is broad.

Practical implication: inventory every externally reachable HMI and PLC and remove internet exposure wherever operationally possible.

Why password and IP changes can be operationally decisive

OT attackers often aim for control disruption rather than silent theft. Changing passwords can lock operators out of devices, while altering IP addresses can break trusted routing, monitoring, and engineering workflows. Those actions are especially damaging in environments where device identity is assumed to be stable and control paths are manually maintained. The result is not just lost access but degraded situational awareness, because monitoring tools may no longer find or trust the affected assets. That is why identity and network configuration are both part of OT resilience.

Practical implication: treat credential and network-configuration changes on control devices as high-severity incidents that require immediate containment.

Why microsegmentation matters after perimeter failure

Microsegmentation limits how far an attacker can move once they enter an environment. In OT, that means separating HMIs, historians, engineering workstations, SCADA servers, PLCs, and the rest of the network so a compromise of one device does not become a plant-wide problem. This is especially important where some assets cannot run agents and must be protected with appliance-based or network-enforced controls. The architecture matters because OT recovery is harder than IT recovery, and manual fallback is often the only safe response once control channels are disturbed.

Practical implication: design OT segmentation around blast-radius reduction, not just perimeter filtering.

Threat narrative

Attacker objective: The objective was to interfere with OT monitoring and control in ways that could disrupt wastewater operations and widen operational risk.

1. Entry occurred through internet-exposed HMI and PLC devices in public water systems, giving attackers a direct route into operational technology networks.
2. Credential and configuration abuse followed as attackers altered IP addresses and passwords, which disrupted normal control and administrative access.
3. Impact emerged when monitoring and control were degraded, forcing some utilities to switch to manual operations and exposing critical infrastructure to service disruption.

Breaches seen in the wild

• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Exposed OT devices create an identity problem before they create a network problem. The core weakness in this incident is not simply open connectivity but unmanaged trust in device reachability and administrative access. When HMIs and PLCs are reachable from the internet, the environment has already lost control over who can issue commands or alter configuration. For practitioners, the right response is to govern OT device identity and exposure as a single risk surface.

Perimeter controls are necessary but structurally insufficient in critical infrastructure. Firewalls, MFA, VPNs, and ZTNA reduce exposure, but they do not change the fact that some initial breaches will succeed. That means OT programmes need containment controls that assume compromise and limit what an attacker can do after first access. For water utilities, resilience depends on shrinking blast radius faster than attackers can exploit the edge.

Device configuration is now part of operational security governance. When attackers can change IP addresses and passwords, the issue is not only access, but the stability of the control plane itself. This is a governance gap because many OT environments still treat network configuration, device authentication, and operational monitoring as separate disciplines. Practitioners should align them under one control model so a single compromise cannot sever visibility and control.

Microsegmentation is the practical control that matches the threat model. The article describes exactly the kind of OT incident where internal separation matters more than perimeter promises. By isolating HMIs, PLCs, and supporting systems, organisations can prevent reconnaissance from turning into lateral movement and manual fallback from becoming an emergency. For critical infrastructure teams, that is the difference between an intrusion and a service-disrupting incident.

OT resilience now depends on defending the control path, not just the corporate network. The physical consequence of a cyber intrusion makes this a governance issue for security, operations, and safety together. Identity teams should care because administrative access to industrial assets is still privileged access, even when the asset is not a traditional server or endpoint. The practical lesson is to bring OT into the same access governance discipline as other high-risk environments.

What this signals

Containment is now the defining control objective for OT environments. The article reinforces a pattern security teams already see across critical infrastructure: once exposed control devices are reachable, prevention alone is not a sufficient design goal. Practitioners should assume some perimeter failures will occur and build segmentation, remote access restriction, and fallback procedures around that assumption.

OT security programmes need to treat device identity as operational infrastructure. HMIs and PLCs are not just assets on a network map. They are control points whose reachability, credentials, and management paths determine whether an intrusion stays local or becomes a service event. That means identity governance for industrial devices belongs alongside network architecture and resilience planning.

For practitioners

• Map all externally reachable OT assets Identify every internet-facing HMI, PLC, engineering workstation, historian, and SCADA component, then remove or tightly broker public exposure.
• Separate OT control paths from general IT traffic Use segmentation rules that isolate control devices and limit which systems can talk to them, especially across remote access and administration channels.
• Treat device password and IP changes as incident signals Alert on unexpected credential changes, address changes, and unreachable control endpoints because those are often the earliest signs of OT disruption.
• Apply privileged access governance to industrial devices Require explicit ownership, approval, and review for accounts and services that can administer HMI and PLC platforms, including emergency access.
• Plan manual operating fallback before an outage Document how operators will safely switch to manual control, verify who can execute that change, and rehearse the handoff under realistic conditions.

Key takeaways

• The article shows that exposed OT devices create a direct path from cyber access to physical process disruption, especially when operators lose visibility and control.
• The impact is not theoretical: attackers changed device settings, disrupted monitoring, and pushed some utilities into manual operations.
• Utilities need containment, segmentation, and privileged access governance that assume perimeter failure instead of relying on it to prevent the first breach.

Key terms

• Operational Technology: Operational Technology is the hardware and software that monitors or controls physical processes such as manufacturing lines, utilities, and transportation systems. Unlike standard IT, OT prioritises uptime and safety, so identity controls must be precise enough to reduce risk without interrupting essential operations.
• Human-Machine Interface: A Human-Machine Interface is the screen or console operators use to observe and control industrial systems. In SCADA, the HMI is often the first identity checkpoint for production actions, which makes shared accounts, weak authentication, and poor logging especially dangerous for accountability.
• Programmable Logic Controller: A Programmable Logic Controller is an industrial device that executes control logic for machinery and processes. PLCs are often trusted to run continuously, so unauthorized access can alter physical behaviour quickly. In modern SCADA governance, PLC access must be tightly scoped and traceable.
• Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.