4,400 Rockwell PLCs Exposed Online as Water Utility Cyberattacks Surge

Why It Matters Now

The industrial automation sector is confronting a cyber-physical security crisis of unprecedented scale. Forescout Research – Vedere Labs has identified more than 4,400 Rockwell Automation programmable logic controllers (PLCs) sitting unprotected on the public internet, exposing critical water infrastructure to remote manipulation. The discovery comes as the FBI and EPA confirm that malicious actors have already breached water and wastewater utilities across at least seven U.S. states, triggering pressure loss, flooding, and complete loss of operational visibility.

For asset owners and systems integrators across the global industrial automation market, this is no longer a theoretical risk. The exposed devices—primarily communicating over EtherNet/IP on port 44818—represent a direct gateway for nation-state-affiliated threat groups to compromise physical processes. With Rockwell controllers forming the operational backbone of thousands of water treatment plants, manufacturing facilities, and energy installations, the findings demand immediate architectural remediation.

The Numbers: A Persistent Exposure Crisis

Forescout's latest analysis, leveraging Shodan telemetry, reveals that 4,407 internet-facing controllers currently expose EtherNet/IP port 44818 globally. Critically, 65% of these devices are located in the United States, followed by Canada at 12% and Spain at 3%. The research further identified that 22 of these exposed PLCs were situated in cities specifically targeted during the recent wave of water utility intrusions—underscoring the direct link between internet visibility and operational compromise.

How the Attacks Unfold: Anatomy of a PLC Breach

The attack chain targeting water utilities follows a disturbingly simple pattern. Malicious actors—which CISA and the FBI have linked to Iranian-affiliated advanced persistent threat (APT) groups—scan the internet for Rockwell MicroLogix 1100 and 1400 series controllers with exposed web and Telnet configuration interfaces. Leveraging default administrative credentials or the known authentication bypass vulnerability CVE-2021-22681, attackers gain full configuration access within minutes.

Step-by-Step Attack Sequence

Once connected, the adversary executes a three-phase disruption: First, they change the PLC's IP address, severing communication with operator HMIs and SCADA systems. Second, they enable or reset the device password, locking legitimate operators out entirely. Third—and most dangerously—in at least one confirmed case, attackers modified the PLC project files themselves, altering ladder logic across multiple sites. The operational consequences reported to the FBI include loss of water pressure, uncontrolled flooding, and an extended Loss of View condition that forced facilities into manual operation.

Regulatory Response: FBI and EPA Joint Advisory

The FBI and Environmental Protection Agency (EPA) issued a joint Public Service Announcement (PSA) warning critical infrastructure operators that malicious cyber actors are systematically targeting internet-exposed Rockwell PLCs. The advisory explicitly names the MicroLogix 1100 and 1400 series and extends caution to other branded controllers including Schneider Electric and Siemens devices.

Simultaneously, CISA released advisory AA26-097A, co-authored with the FBI, NSA, EPA, DOE, CNMF, and Treasury, confirming Iranian IRGC-affiliated actors are exploiting CVE-2021-22681 at scale. The multi-agency response signals that the threat has crossed the threshold from isolated incident to national security concern.

Global PLC Exposure and Industrial Automation Risk Landscape

Beyond Rockwell, the broader picture of industrial controller exposure remains alarming. Forescout's longitudinal research shows that nearly half of all reported vulnerable PLCs retained the same open ports one year after initial CISA notification—without any protective measures implemented. Only 30% were fully removed from internet exposure, while 20% remained exposed but had closed the specific OT port under scrutiny. This demonstrates that awareness alone does not drive remediation; enforceable standards and active monitoring are essential.

Why Legacy PLCs Remain Internet-Facing

The persistence of internet-exposed PLCs is not solely a technical problem—it is an organizational and procurement failure. Many water utilities and municipal facilities operate on constrained budgets with minimal cybersecurity staffing. Remote access was historically configured for vendor maintenance convenience, often without VPN gateways, and subsequently forgotten. Compounding this, legacy controllers like the MicroLogix 1100—first introduced over two decades ago—lack modern authentication mechanisms and encryption capabilities, making them fundamentally indefensible when placed on a public network.

Water Utility Cyberattacks: A Recurring National Emergency

The current campaign against Rockwell PLCs did not emerge in isolation. U.S. utilities experienced 1,162 cyberattacks in 2024—a nearly 70% year-over-year increase from 689 attacks in 2023. By Q3 2024, weekly incidents averaged 1,339, representing a staggering 234% annual surge according to Check Point Research. Earlier intrusions targeting Unitronics PLCs at water facilities demonstrated the same core vulnerability: internet-exposed controllers with default credentials, exploited by hacktivist groups claiming geopolitical motivations.

The geographic spread now encompasses at least seven states, with Minnesota emerging as a focal point where over 30 systems were targeted simultaneously—suggesting either a shared technology dependency, a common service provider, or a coordinated state-level IT backbone that attackers exploited at scale.

The Economics of PLC Exposure: Industrial Cybersecurity Market Dynamics

The industrial automation market faces a stark economic reality: the cost of securing legacy PLC infrastructure is dwarfed by the potential financial and public health consequences of a successful attack. Water system disruptions can contaminate drinking supplies, cause property damage through flooding, and erode public trust—each carrying seven-figure remediation costs. Yet many municipal operators continue to rely on flat network architectures designed before cybersecurity entered the operational lexicon.

The industrial cybersecurity market's projected growth to $61.18 billion by 2035 reflects a belated but accelerating recognition that OT environments require purpose-built defenses. Traditional IT security tools cannot inspect EtherNet/IP, Modbus, or DNP3 traffic with sufficient granularity to detect the subtle configuration changes characteristic of PLC-targeted intrusions. This capability gap is driving investment in OT-aware monitoring platforms from vendors including Dragos, Claroty, Nozomi Networks, and Forescout itself.

Looking Ahead: From Awareness to Enforcement

The Forescout findings represent a watershed moment for industrial automation security. With over 4,400 Rockwell PLCs still exposed and threat actors actively exploiting this vulnerability at scale, the era of voluntary compliance is giving way to regulatory enforcement. The EPA's involvement signals that water quality and public health regulators now view cybersecurity as integral to operational integrity—not a separate IT function.

For the global industrial automation community—systems integrators, OEMs, and end-users alike—the path forward requires fundamental architectural change: zero-trust network segmentation, continuous OT-aware monitoring, and procurement policies that mandate secure-by-design controller configurations. The exposed devices documented by Forescout are not anomalies; they are the visible edge of a systemic vulnerability that extends across every sector of critical infrastructure.