Your water utility's PLC is on Shodan — and CISA says it's being scanned

What happened

Censys published a technical breakdown of CISA's latest advisory on the water and wastewater sector, and the picture is grim in a familiar way. Researchers found hundreds of programmable logic controllers (PLCs) belonging to US water utilities directly reachable from the public internet, many still running factory-default credentials or exposing management interfaces on well-known industrial ports like 502 (Modbus) and 44818 (EtherNet/IP).

The advisory names specific hardware families — Unitronics Vision series, Allen-Bradley MicroLogix, and Siemens S7 controllers — that have been actively probed by actors CISA attributes to IRGC-affiliated groups (the same crew behind the 2023 Aliquippa, PA water authority intrusion) and, separately, Volt Typhoon-linked reconnaissance. In the Aliquippa incident, attackers replaced the PLC's HMI screen with anti-Israel messaging; the utility caught it because the pressure regulation logic tripped an alarm, not because anyone was watching the network.

Censys's scan data shows the exposure isn't hypothetical or historical. As of the report, they identified live Unitronics devices on default port 20256 with the manufacturer's stock password (`1111`) still accepted, and Modbus endpoints answering unauthenticated function code queries. This is 2026 and the front door is still unlocked.

Why it matters

The temptation for anyone in commercial software is to file this under "someone else's problem" — critical infrastructure, government's job, ICS specialists handle it. That framing is wrong on two counts.

First, the failure mode here is the same failure mode that hits every industry the moment operational technology touches an IP network: devices designed for air-gapped serial buses get wired up to Ethernet, then to a VPN, then to a jump host that gets exposed "temporarily" during a pandemic, and never gets taken down. The Unitronics units at Aliquippa were reachable because a contractor set up remote access for maintenance and left it running. That exact pattern shows up in manufacturing, building automation, EV chargers, solar inverters, and increasingly in warehouse robotics — anywhere a vendor sells a "connected" upgrade to hardware that was originally isolated.

Second, the defender economics are terrible in a way that should interest anyone building infrastructure tooling. A water utility serving 15,000 people typically has zero full-time IT staff, let alone an OT security engineer; the "SOC" is a plant operator checking a Windows XP HMI between rounds. CISA's guidance boils down to "change default passwords, put it behind a VPN, enable MFA on the VPN" — advice that assumes a level of operational maturity these organizations don't have and can't afford to acquire. The gap between the advisory and the reality is where the intrusions happen.

The community response on Hacker News has been unusually pointed. Several commenters with utility-sector experience noted that the regulatory framework (EPA has cybersecurity authority under the Safe Drinking Water Act, but enforcement was gutted by a 2023 court ruling) means there's no stick and no carrot — utilities that invest in security get no rate-case credit for it, and utilities that don't face no penalty until something breaks. One ex-operator's comment: "We got quoted $40k/year for a managed OT firewall. Our entire IT budget is $22k."

The technical mitigations aren't hard. Segmenting OT from IT, putting PLCs behind a Tailscale or WireGuard tunnel, disabling remote programming on the controller itself, and monitoring for unexpected function codes on Modbus traffic would kill 90% of this class of attack. None of it requires nation-state defensive capability. It requires someone whose job it is to do it.

What this means for your stack

If you don't work in critical infrastructure, the direct action item is narrow: run a Shodan or Censys query against your own egress IPs and any vendor equipment you've deployed at customer sites, and see what answers on 502, 44818, 20256, 102, or 1911. You will find something. Building automation gateways, badge readers, HVAC controllers, and CCTV DVRs all get shipped with the same "plug it in and it works from anywhere" defaults that Unitronics ships with.

If you build software that touches OT or IoT, the design implication is that your customers will deploy your product exactly as insecurely as physically possible, and the burden of secure defaults is entirely on you. Ship with authentication required, ship with the management interface bound to localhost, ship with an explicit opt-in for remote access, and log every configuration change with an operator identity. The Unitronics story is what happens when "convenient for the field tech" wins the design argument.

For anyone building security or observability tooling, there's a real market gap for something that looks like "Datadog for a water plant" — cheap enough that a $22k/year IT budget can afford it, opinionated enough that it doesn't require an OT engineer to configure, and specific enough that it catches the actual attack patterns (unexpected Modbus writes, HMI changes outside a maintenance window, new outbound connections from a PLC). The incumbents in this space (Claroty, Dragos, Nozomi) price for utilities that serve millions, not thousands. That leaves 50,000+ small water systems in the US alone with no viable option.

Looking ahead

The CISA advisory will get one news cycle, a few utilities will change their default passwords, and the underlying condition will not change until either the EPA gets enforcement authority back or an incident causes actual physical harm. The realistic forecast is that the next public breach won't be defacement — it'll be a chlorine dosing change that gets caught downstream, or a pressure spike that ruptures old pipes, and the postmortem will read exactly like this advisory does today. The tooling and the knowledge to prevent it already exist. The distribution problem is the one nobody is solving.