Water system attacks expose the fragility of internet-facing PLCs

At a glance

What this is: This is an analysis of recent OT attacks against U.S. water and wastewater systems, showing that exposed PLCs and default credentials were enough to disrupt operations.

Why it matters: It matters because OT teams need proof that internet exposure, weak segmentation, and unmanaged remote access are being governed in the live environment, not just on paper.

Context

Operational technology security fails when the live environment does not match the architecture diagram. In water and wastewater systems, the practical risks are internet exposure, default credentials, and unmanaged remote access paths that can let a simple configuration change interrupt physical operations.

This topic has a clear identity angle where operators, vendors, and system integrators retain remote access to field devices. In that setting, access governance, segmentation validation, and credential hygiene become part of OT resilience, not just account administration.

The Corelight article uses recent U.S. water-system attacks to show that the disruptive step was often mundane, not technically sophisticated. That makes inventory accuracy and network-validated segmentation the central control problem, especially where legacy devices cannot be taken offline easily.

Key questions

Q: What breaks when internet-facing PLCs still use default credentials?

A: Attackers can authenticate with minimal effort and then alter device settings, break communications, or interrupt the physical process the PLC supports. In OT, that failure often looks operational first and cyber second, which is why exposed devices must be treated as a direct availability risk, not just an authentication weakness.

Q: Why do small configuration changes create such large OT outages?

A: Many OT systems depend on fixed addresses, stable routing, and tightly coupled device-to-system relationships. If a PLC’s IP address or mode changes unexpectedly, dependent systems may stop finding it even though the hardware is still online. The outage can therefore begin with a minor edit that cascades into lost control or loss of communications.

Q: How do teams know if OT segmentation is still working?

A: OT segmentation is working only if access decisions remain accurate when systems move, scale, or connect to new platforms. If the programme depends on frequent manual rule edits, exceptions, or subnet assumptions to keep traffic flowing, the control is already drifting away from the operational reality it is meant to protect.

Q: Who is accountable for remote access into critical OT devices?

A: Accountability should sit with the team that owns both the operational outcome and the access path, which usually means OT operations, network security, and vendor management together. Remote access must be approved, documented, segmented, and periodically revalidated because it can become standing privilege into devices that support essential services.

Technical breakdown

Internet-facing PLCs and default credentials

Programmable logic controllers are the control devices that execute operational commands in OT environments. When they are reachable from the internet and still use default credentials, the attack surface becomes trivial to discover and abuse. The article’s key point is that the attacker does not need deep process knowledge to reach a device, authenticate, and change settings. Once access is obtained, the device can be used as a foothold to alter communications or operating parameters without touching higher-level systems.

Practical implication: remove internet exposure and eliminate default credentials before an exposed PLC becomes a low-effort entry point.

Configuration changes that break OT communications

OT systems often depend on fixed addressing and tightly coupled communications paths. If an attacker changes an IP address or another device setting, upstream systems may stop finding the device even though the hardware is still powered on. That creates a disruption pattern that looks operational rather than overtly malicious. In many environments the change can be enough to stop telemetry, break control traffic, or force operators into manual recovery while the underlying device remains technically online.

Practical implication: monitor for unauthorized configuration changes, not just malware alerts, because small device edits can create outsized outage impact.

Why network telemetry matters when endpoints are blind

Many OT devices cannot run conventional endpoint agents, which removes a major source of host-based detection. Network evidence therefore becomes the primary way to understand what a device communicated with, which protocol was used, how long the session lasted, and whether commands or files moved. In these incidents, richer network context is especially important because a successful login to an exposed device may look legitimate unless the session is compared to normal process behavior. That is where protocol awareness and baseline analysis become decisive.

Practical implication: collect network-level evidence that can explain session behavior on devices that cannot host security agents.

Threat narrative

Attacker objective: The objective was to disrupt OT communications and operational continuity by changing exposed devices in ways that caused service interruption.

1. Entry occurred when attackers located internet-facing PLCs and authenticated with default credentials that were likely easy to discover.
2. Escalation came from changing device configuration, including IP address settings, which altered how operators and dependent systems could reach the equipment.
3. Impact followed when communications failed and operators had to intervene to keep water-system operations running.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Exposure, not sophistication, is the governing failure here: the attacker only needed internet reachability and weak authentication to cause disruption. In OT, that means the real control gap is not advanced tradecraft but unmanaged access paths and credentials left in place. Practitioners should treat every externally reachable PLC as a governance issue, not just a network topology issue.

Configuration integrity is the hidden control plane in OT: a small change such as an IP address edit can sever communications without destroying equipment. That creates a failure mode where the device still exists, but the process can no longer find it. Security and engineering teams need to treat configuration drift as an operational risk, not an abstract cyber finding.

Identity and access control extend into OT remote maintenance: vendor access, system integrator access, and operator remote access all create live trust paths into field devices. If those paths are undocumented or poorly segmented, they become the practical equivalent of standing privilege. The discipline here is validating who can touch which device, through which route, and under what operational constraints.

Network evidence is the only reliable witness in many OT investigations: if endpoint telemetry is unavailable, the environment must still provide enough session context to explain what a device did and when it changed state. That shifts the governance burden to asset visibility, protocol-level inspection, and baseline comparisons. Practitioners should assume that outages will only be explainable if telemetry existed before the outage began.

What this signals

OT exposure management is the real lesson: the attack path described here is simple, but simplicity is what makes it dangerous. If external reachability, remote maintenance links, and device defaults are not continuously verified, the environment can remain one misconfiguration away from service disruption.

Configuration drift will outpace manual review in long-lived industrial environments: devices, modems, and vendor access paths accumulate over time, and older sites are especially vulnerable to undocumented connectivity. Practitioners need recurring validation that the live communications pattern still matches the approved segmentation model.

Identity governance now extends to maintenance pathways: remote operator access, vendor logins, and system integrator connections are part of the attack surface when they reach field devices. Access reviews that stop at corporate IAM miss the operational trust relationships that matter most in OT.

For practitioners

• Inventory all internet-facing OT assets Validate which PLCs, cellular modems, routers, and vendor-maintained devices are actually reachable from outside the OT boundary. Compare discovered exposures against the asset register and remove any connectivity that is not operationally required.
• Eliminate default and shared credentials Replace factory defaults and shared logins on exposed devices with uniquely assigned credentials and tight administrative ownership. Where device support is limited, compensate with compensating access controls and documented exceptions.
• Verify segmentation with live network data Test whether isolated OT zones are truly isolated by tracing actual communications, including vendor access and remote admin paths. Treat any unseen path into a supposedly air-gapped environment as a control failure.
• Monitor configuration changes on critical devices Alert on IP address edits, mode changes, new commands, and unusual session duration on PLCs and similar field devices. Pair alerts with engineering review so legitimate maintenance can be distinguished from malicious reconfiguration.
• Preserve protocol-level session context Capture enough network detail to reconstruct who connected, which protocol was used, what commands were sent, and whether files or data moved. This is essential where endpoint agents cannot be installed.

Key takeaways

• Internet-facing PLCs with default credentials create a direct path from trivial access to real operational disruption.
• The disruptive step in these attacks was often a configuration change, which shows how fragile OT availability becomes when device settings are altered.
• OT teams need live asset visibility, segmentation validation, and protocol-level monitoring before a small access mistake turns into an outage.

Key terms

• Programmable Logic Controller: A Programmable Logic Controller is an industrial device that executes control logic for machinery and processes. PLCs are often trusted to run continuously, so unauthorized access can alter physical behaviour quickly. In modern SCADA governance, PLC access must be tightly scoped and traceable.
• Segmentation Drift: Segmentation drift is the gap between the access or communication policy a team thinks it has and the controls actually enforced across environments. In multi-cloud estates, drift appears when cloud-specific rules, manual exceptions and inconsistent visibility gradually weaken the intended trust boundary.
• Configuration integrity: The property that a trusted file, policy, or routing rule has not been altered since it was approved. In agentic access flows, this matters because a valid approval can become unsafe if the underlying configuration changes and still triggers the same trusted execution path.
• Request-Level Telemetry: Request-level telemetry is event data captured for each model call, including fields such as model name, token counts, cost, and identity identifiers. It gives operators enough context to aggregate usage, investigate anomalies, and reconcile estimated spend against provider billing.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.