Two configuration writes cover most of the damage described. Change a controller's IP address and the HMI or historian that polls it stops finding it. Change the password and the engineer who would undo that is locked out of the device [2]. That is the shape of these incidents: utilities lost monitoring and control, and some took operational disruption [3], without confirmed widespread drinking-water contamination [c3b]. None of it needs OT-specific tooling. It needs a reachable controller and credentials that work.
CISA names the delivery route plainly. Directly connecting PLCs to the internet through cellular modems "can create significant security risks," the agency said in its guidance [6]. The fixes it lists are removal and interposition rather than detection: strip unnecessary remote access, and route legitimate access through a secure gateway, firewall, VPN or centrally managed solution instead of pointing it at a PLC, HMI or RTU [7]. Then the housekeeping, which is the same housekeeping as ever: default passwords, security patches, replacement of unsupported equipment, and multifactor authentication where the gear supports it [8].
The headline number needs care. Minnesota confirmed malicious activity involving more than 30 community water systems [5]. Set against a national figure of more than 100, that is at least 30 percent of the count sitting in one state [15]. The units are not the same, since Minnesota is counting community water systems with confirmed activity and CISA is counting internet-exposed systems targeted, so read the share as a rough proportion rather than a statistic. CISA's own caveat runs the same direction: the count measures systems targeted, and does not establish successful breaches, separate compromised utilities, or one actor behind all of it [11].
The line in the guidance that does the most work is the one about third parties. Vendors and contractors install and maintain equipment that faces the internet and never reaches the utility's asset register, so the exposed device is the one the operator would not think to check [9]. CISA's suggested starting point is accordingly discovery, not deployment: inventory internet-facing equipment, remove unnecessary direct connections, and verify systems installed or maintained by vendors and contractors [13]. It also points operators at Shodan, Censys and Shadowserver [14]. For a small provider whose security work competes with operational demands and a thin budget [12], that is the cheap end of the problem, because it is the same public scan data an attacker uses, read first by the utility.
