As reported by The Hacker News, Forescout researchers have identified over 4,400 Rockwell Automation programmable logic controllers (PLCs) exposed directly to the internet, including a troubling cluster of 22 devices located in cities that have recently experienced cyberattacks targeting US water utilities. The finding is a stark reminder that operational technology (OT) exposure in critical infrastructure is not a theoretical risk — it is an active, measurable, and deeply concerning reality.
Why This Finding Demands Immediate Attention
PLCs are not enterprise servers. They are purpose-built control systems designed to operate machinery, manage chemical dosing, control pumps, and regulate water pressure in real time. Exposing them directly to the internet eliminates multiple layers of defense that industrial security frameworks consider foundational. There is no patch cycle that mitigates the risk of a PLC that should never have been internet-routable in the first place.
What makes the Forescout data particularly alarming is the geographic correlation: 22 exposed Rockwell controllers in cities that have already been targeted. This is not random exposure — it suggests a systemic pattern in how smaller and mid-sized water utilities are deploying remote access infrastructure, likely driven by budget constraints, staffing shortages, and a misplaced reliance on cellular connectivity as a security boundary.
Shield53 Assessment: The concentration of 19 devices sharing the same mobile carrier network strongly suggests these facilities used a common managed service provider or integrator for remote access configuration. A single compromised carrier account or SIM-swapping event could provide lateral access to multiple water systems simultaneously.
The Threat Landscape These Devices Face
Rockwell Automation PLCs — particularly the MicroLogix, ControlLogix, and CompactLogix families commonly deployed in water treatment — have been targeted by nation-state and criminal threat actors before. CISA has previously issued advisories about vulnerabilities in these product lines. More critically, many deployed units in water utilities run firmware versions that are years or decades out of support, making patching a non-option even when vulnerabilities are known.
The attack surface here extends beyond remote code execution. Adversaries with network-level access to an exposed PLC can:
The Systemic Failure Behind the Numbers
The 2,844 US-based exposures are not solely a technology failure — they represent a governance failure. EPA and state-level water security regulations have historically lacked the enforcement teeth and technical specificity needed to drive OT network segmentation. Many small water utilities operate with part-time IT staff who lack OT security expertise entirely, and the economics of rural water systems make dedicated ICS security personnel unrealistic without federal support.
The cellular connectivity pattern Forescout identified is particularly instructive. Direct cellular modems attached to PLCs for remote monitoring are a common shortcut — they provide remote access without requiring firewall configuration or VPN infrastructure. But they also create a direct path from the public internet to the control plane of physical infrastructure, bypassing every network security control the utility may have in place.
Shield53 Recommendations
For Water Utility Operators and OT Security Teams
- Immediately audit internet-facing OT assets. Use tools like Shodan, FOFA, or your vendor's asset discovery platform to identify any PLC, HMI, or SCADA component with a public IP. If it's on the internet, it should not be.
- Replace direct cellular modem connections with VPN-gated remote access. Cellular connectivity should terminate in a DMZ with two-factor authentication, not directly on the OT network. Consider industrial-grade secure remote access platforms (e.g., Tosibox, Secomea, or Claroty xDome).
- Implement network segmentation per IEC 62443. PLCs should reside in a Purdue Level 1 zone with no direct inbound internet connectivity. Any remote access should traverse a jump host with full session logging.
- Deploy OT-aware network monitoring. Solutions such as Dragos, Claroty, or Nozomi Networks can detect anomalous PLC command sequences, unauthorized configuration changes, and lateral movement in ICS environments.
- Contact CISA's free ICS assessment program. CISA offers no-cost cybersecurity assessments for water sector entities through its CSET and RVAT programs. Take advantage of this resource before an incident forces the issue.
- Review and rotate any shared credentials on Rockwell controllers, particularly if a common integrator or MSP was used for deployment. Default credentials remain a persistent entry point in OT environments.
For CISOs and Risk Managers in Adjacent Sectors
If your organization depends on municipal water supply for operations — data centers, hospitals, food manufacturing, pharmaceutical facilities — this finding is a supply chain risk that belongs in your threat model. Consider redundant water storage and treatment contingency planning as part of your operational resilience posture.
The Forescout data provides a rare, quantified look at a problem the security community has warned about for years. The question is no longer whether critical infrastructure OT systems are exposed — the scan data answers that definitively. The question is whether the industry and government will act with the urgency this exposure demands before an adversary does.
