Water utility OT gaps persist from exposed PLCs to loss of control

At a glance

What this is: This is a Dragos analysis of how two water sector intrusions, a decade apart, exposed the same OT control gaps around internet-facing devices, access control and operational visibility.

Why it matters: It matters because water utilities and their security teams still have to govern remote access, segmentation and patch prioritisation in environments where loss of view and loss of control can become service impact.

Context

Water and wastewater operations depend on industrial control systems that were not designed to be exposed to the public internet. When those devices are reachable remotely, the security problem shifts from perimeter defence to direct governance of access, visibility and operational continuity. This analysis is strongest when read alongside OT and ICS identity and access because the issue is not just connectivity, it is who or what can reach the control path.

The article’s core claim is that the sector has known about this exposure for years, yet the same weaknesses still recur. That makes the current risk less about a new attack technique and more about persistent operational debt in OT security.

For water utilities, that pattern is typical rather than exceptional: the gap is structural, not isolated.

Key questions

Q: What breaks when OT devices are exposed to the internet?

A: Internet exposure turns HMIs and PLCs into reachable control points rather than protected field assets. Once attackers can authenticate or exploit them, they can alter process settings, change credentials, and disrupt monitoring. The practical failure is not only compromise of a device, but loss of trust in the control plane that keeps physical operations stable.

Q: Why do weak credentials and bypassable authentication create outsized OT risk?

A: Because many OT environments rely on devices that are expected to be stable for long periods, so a small authentication failure can persist unnoticed and give an attacker durable control. When passwords can be reset, shared access is common, or device authentication is weak, the attacker can maintain operational influence with very little noise.

Q: How should utilities prioritise OT vulnerabilities when patching is slow?

A: They should prioritise based on whether the asset is reachable, whether the weakness is already known to be exploited, and how much operational impact a compromise would create. In OT, patch dates alone are a poor triage method. Context is what separates tolerable exposure from active risk.

Q: Should water utilities treat remote access governance as part of operational resilience?

A: Yes. Remote access is not just an IT convenience in water environments. It is part of the operational control plane, so access design, authentication, segmentation and manual fallback planning all affect resilience. If those controls are weak, a connectivity problem can quickly become a service continuity problem.

Technical breakdown

How exposed controllers become operational entry points

OT devices that are directly reachable from the internet collapse the usual assumptions about segmented industrial networks. In this article, attackers reached PLCs through cellular links and an exposed SCADA device, then interacted with live operational systems rather than an isolated lab environment. Once that happens, the problem is no longer just malware execution. It is direct access to control functions, status data and device settings. In OT, especially water, connectivity is often added for convenience and remote operations, but without strict zoning it becomes a standing attack surface. Practical implication: treat every externally reachable controller as a high-risk access path that must be justified, inventory-backed and continuously monitored. See the OT Security Guide. See the OT Security Guide.

Practical implication: inventory and segment any controller that can be reached from outside the plant network.

Why weak authentication and default access still matter in OT

The article points to weak credentials, default access and authentication bypass as recurring features of water-sector compromise. In control environments, authentication is often only one layer among several, but if an attacker can reset passwords, change device settings or exploit a known bypass, the operational boundary fails quickly. OT identities are frequently tied to devices rather than people, and many environments still rely on shared, long-lived or poorly governed access paths. That makes account hygiene and credential lifecycle management as important in OT as in IT, even though the operational constraints are different. Practical implication: align remote access, device credentials and administrative rights to a governed identity model instead of ad hoc field configuration. See the OT and ICS Identity and Access Guide. See the OT and ICS Identity and Access Guide.

Practical implication: govern device and operator credentials with the same lifecycle discipline you apply to privileged IT accounts.

Why patch latency becomes a security exposure in water OT

The Minnesota case highlights a familiar OT pattern: a vulnerability is disclosed, then remains exploitable for years because operations cannot easily absorb downtime. That delay is not a technical mystery. It is a prioritisation failure created by uptime pressure, safety constraints and the lack of environment-specific risk scoring. In OT, patching every issue immediately is unrealistic, so the control problem becomes reachability, exposure and compensating safeguards. When a known, internet-reachable vulnerability stays open across a utility fleet, the attacker does not need novelty. They need patience. Practical implication: use vulnerability context, not disclosure date alone, to decide what must be fixed first. See the OT Security Maturity Model. See the OT Security Maturity Model.

Practical implication: prioritise remediation by reachability and operational impact, not by CVSS alone.

Threat narrative

Attacker objective: The objective was to gain control over water infrastructure devices and deny operators their normal ability to monitor and manage them.

1. Entry occurred through internet-facing OT controllers and SCADA systems that were reachable over cellular links or exposed directly to the public internet.
2. Credential access and device control followed when attackers reset passwords, changed IP addresses or used weak and bypassable authentication to hold the devices.
3. Impact came from the loss of visibility and operational control, which forced manual operations and in some cases offline shutdown of utility systems.

Breaches seen in the wild

• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Exposed OT connectivity has become a governance failure, not just an architecture choice. Water utilities did not merely inherit internet exposure by accident. They created remote access paths for legitimate operational reasons and then left too many of them insufficiently segmented, monitored or controlled. In that sense, the recurring problem is governance of reachability: who can touch which controller, from where, and under what operational conditions. That is the control boundary that failed at both Bowman and Minnesota.

Loss of visibility is the decisive failure mode in water OT. The sector often focuses on whether data was stolen or ransomware was deployed, but in these cases the more immediate outcome was operators losing sight of and control over their own systems. That matters because OT safety depends on timely human decision-making. When the environment becomes opaque, the attacker does not need destructive payloads to create impact. The absence of OT security guidance is what turns simple access into operational risk.

Standing access assumptions break down when adversaries target devices, not users. Water sector defenders still tend to think in terms of accounts and endpoints, yet the attack surface here is often a controller with persistent remote reachability and limited local hardening. The named concept is exposed control plane drift: the slow normalization of externally reachable OT assets that were never meant to be public. Once that drift sets in, traditional perimeter thinking no longer matches the actual risk.

Patch latency in OT is a risk acceptance decision, not a maintenance delay. The five-year gap between disclosure and exploitation of the cited vulnerability shows that some environments effectively carry known exposure as a normal operating condition. That does not mean every patch should be rushed into production. It does mean the sector needs explicit decisions about exposure, compensating controls and acceptable delay, rather than assuming the risk will age out on its own.

Water sector resilience now depends on collective defence, not isolated utility maturity. The article makes clear that similar techniques were used across many sites and states. That pattern favours shared intelligence, common monitoring expectations and sector coordination over one-off local fixes. Practitioners should treat repeated exploitation as a sector-wide governance problem, not a one-site anomaly.

What this signals

Exposed control plane drift: water OT becomes materially harder to defend when remote connectivity normalises public reachability for controllers that were never intended to be internet-facing. The practical response is to make reachability a governed state, not a convenience feature.

The sector should assume that adversaries will continue to look for the same combination of reachable controllers, weak access paths and delayed remediation. That means resilience programmes need to focus on segmentation, access governance and recovery from loss of control rather than on detection alone.

When a utility cannot prove which devices are reachable, who can access them and how quickly they can be isolated, it has a governance problem before it has a cyber incident.

For practitioners

• Remove unnecessary public internet exposure Pull OT controllers, HMIs and related access paths off the public internet wherever they do not have a justified operational need, and replace direct exposure with controlled remote access paths.
• Govern remote access like privileged access Route all vendor and operator remote sessions through managed gateways, restrict device-level credentials, and separate authentication for operators from authentication for plant equipment.
• Build an OT asset exposure inventory Map every externally reachable PLC, cellular endpoint and remote management service so you can see which assets are reachable, by whom and from which networks.
• Prioritise remediation by exploitability in context Use vulnerability reachability, operational criticality and known adversary use patterns to decide which flaws to fix first, instead of treating every disclosed issue as equally urgent.
• Exercise incident response for loss of control Test how operators will switch to manual operation, confirm decision rights and preserve service continuity when visibility drops or controllers are locked out.

Key takeaways

• The recurring weakness in these water sector incidents was not novel malware but exposed OT systems and weak control boundaries.
• The evidence shows the same pattern across a decade: internet-reachable controllers, delayed remediation and loss of operator control.
• Utilities reduce this risk by governing remote access, segmenting controllers and planning for manual fallback before disruption occurs.

Related NHI Mgmt Group resources: OT and ICS Identity and Access Guide · OT Security Guide · OT Security Maturity Model · OT Incident Response Guide

Key terms

• Control plane drift: Control plane drift is the gradual mismatch between intended security or operational policy and the actual state of a system’s control layer. It occurs when configuration changes, automation, or exceptions accumulate without review. In identity and cloud environments, drift can weaken access controls, logging, segmentation, and enforcement consistency.
• Loss of Visibility: A condition where operators can no longer see the live state of their OT environment, including device status, alarms or process conditions. In critical infrastructure, visibility loss is not just an observability issue. It can quickly become a safety and continuity issue because it delays informed control decisions.
• Loss of Control: Loss of Control is the failure of an operator or automated system to maintain command over a process, asset, or device. It can follow credential compromise, malware, communication failure, or unsafe logic changes, and defenders watch for unplanned mode changes, command delays, loss of telemetry, and inability to enforce safety limits.
• Operational Technology Reachability: The extent to which industrial assets can be accessed from outside the intended control environment. Reachability becomes a security issue when it bypasses segmentation, exposes devices to the internet or allows remote management paths that are not tightly governed and monitored.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course, the industry's only accredited NHI security programme. It is suitable for practitioners who need to connect identity governance to broader security operations.