Why it matters now: In the span of just ten days, the industrial automation community watched a cornerstone of OT security guidance collide with real-world exploitation. On July 30, 2026, the FBI and EPA urged water-sector operators to adopt private Access Point Names (APNs) for securing PLC cellular connections. By August 9, researchers at DEF CON 34 demonstrated that those same private APN architectures — when left in their default configuration — had been weaponized to bridge attacks across unrelated Polish energy sites. The lesson is stark: no single perimeter defense, however recommended, is self-securing.
The FBI–EPA Advisory: A Response to an Escalating PLC Threat Landscape
The joint Public Service Announcement (PSA) issued by the FBI and Environmental Protection Agency on July 30, 2026, was not a theoretical precaution. It was triggered by confirmed operational disruptions at water and wastewater utilities across at least twelve U.S. states. Attackers specifically targeted Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 series programmable logic controllers — legacy workhorses still widely deployed in municipal water systems — by scanning for internet-facing devices and altering IP configurations or passwords to lock operators out of their own infrastructure.
Among the remedial measures, the advisory explicitly recommended that organizations "consider implementing isolated architectures, such as private APN" for cellular modem connections to OT assets. The logic was sound: a private APN routes device traffic through a dedicated carrier-managed pathway rather than the public internet, creating what the industry has long treated as a walled-off, trusted perimeter for critical infrastructure communications.
Analyst Insight — The Exposure Window: The July 2026 campaign required no zero-day exploits or advanced persistent threat techniques. Attackers simply scanned for exposed, unhardened PLCs with factory-default or weak credentials. The FBI noted that the determining factor in operational impact was not adversary sophistication but whether the utility could still run its process manually — a sobering metric for any industrial operator relying on connected automation.
DEF CON 34: When the Walled Garden Has No Walls
Ten days after the FBI advisory, Marcin Dudek — head of CERT Polska — took the stage at DEF CON 34 in Las Vegas and presented findings that fundamentally complicate the private APN security narrative. CERT Polska's investigation, spanning more than three months following a December 29, 2025, coordinated attack on Polish energy infrastructure, uncovered a previously unobserved entry vector: an attacker reached a PLC at a combined heat and power (CHP) plant through the distribution system operator's private APN.
The attack chain was chillingly straightforward. The PLC's web administration interface was reachable through the private APN and — critically — still protected with factory-default administrator credentials. Once authenticated, the attacker enabled SSH access and used the compromised PLC as a beachhead to pivot deeper into the plant's operational technology network. The consequences were severe: a steam turbine and the process-water treatment station were shut down, affecting heat supply to approximately 50,000 residents.
But the most technically significant finding went further. CERT Polska discovered that the private APN lacked client isolation — meaning every device on that APN could communicate with every other device. The attacker had first compromised a wind farm connected to the same APN and then simply traversed the shared cellular network to reach the CHP plant's PLC. What was sold as a dedicated, segmented pathway was, in practice, a flat, shared surface.
Analyst Insight — The Client Isolation Gap: CERT Polska's surveys of Polish organizations using private APN-based solutions found that the vulnerable configuration — no client isolation — was widespread. The agency stated it believes the same misconfiguration is common in other countries. The core finding is not that private APNs are inherently insecure, but that the industry's default assumption that they are secure-by-default is dangerously wrong.
The Real Lesson: Defense-in-Depth Is Non-Negotiable
This is not a story about private APNs being bad architecture. Properly configured — with client isolation explicitly enabled — they remain a legitimate and more secure option than public cellular connections for reaching industrial equipment remotely. The FBI advisory was not wrong to list them among recommended isolated architectures alongside ZTNA, 5G PNI-NPN, and site-to-site VPNs.
What the Poland case exposes is the peril of treating any single architectural control as a complete security solution. The attacker exploited not one failure but a cascade: an unverified APN configuration, factory-default credentials on a production PLC, and the absence of network-level detection that would have flagged anomalous inter-site traffic. Each layer failed independently; each layer could have stopped the attack independently.
Market Trend: The convergence of IT and OT security governance is accelerating in response to incidents like these. Industrial operators are increasingly demanding that cellular carriers provide auditable proof of APN client isolation, and PLC manufacturers face renewed pressure to eliminate factory-default credential workflows from their deployment processes.
What Industrial Operators Should Do Now
For asset owners and system integrators managing PLC deployments across water, energy, and manufacturing sectors, the following actions are immediately warranted:
-
Verify APN configuration: Contact your mobile carrier and request documented confirmation that client isolation is enabled on every private APN in use. Do not assume it is the default.
-
Eliminate default credentials: Audit every PLC, RTU, and edge device for factory-default passwords. Implement a credential vault or centralized authentication where feasible.
-
Segment internally: Even within a private APN, enforce network segmentation so that a compromised field device cannot freely communicate with every other asset on the same cellular fabric.
-
Monitor east-west traffic: Deploy OT-aware network detection that can flag anomalous lateral movement between sites that should not normally communicate.
Key Technical Findings from CERT Polska's Investigation
| Finding |
Detail |
| Entry Vector |
Private APN shared across DSO-managed energy sites without client isolation |
| Initial Access |
PLC web administration interface protected by factory-default credentials |
| Privilege Escalation |
Attacker enabled SSH on the PLC post-authentication |
| Lateral Movement |
Pivoted from wind farm compromise through shared APN to CHP plant |
| Operational Impact |
Steam turbine and process-water treatment station shut down; 50,000 residents affected |
| First of Its Kind |
First observed case of OT network compromise via private APN as entry vector |
FBI–EPA Advisory: Recommended Architectures at a Glance
| Architecture |
Key Consideration Post-DEF CON |
| Private APN |
Must verify client isolation is enabled; not secure by default |
| 5G PNI-NPN |
Enhanced segmentation capabilities but requires similar verification |
| ZTNA |
Identity-aware access reduces blast radius; still requires device hardening |
| Site-to-Site VPN |
Mature technology; endpoint compromise still yields network access |
Frequently Asked Questions
Q: Are private APNs still a valid security control for OT cellular connections?
A: Yes. When client isolation is explicitly enabled and verified, private APNs remain significantly more secure than public internet-exposed cellular connections. The Poland incident demonstrates that the configuration must be verified, not that the architecture itself is flawed.
Q: What PLC models were targeted in the July 2026 U.S. water-sector attacks?
A: The FBI confirmed attacks specifically targeted Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 series PLCs, though the advisory noted that other internet-facing OT devices are also at risk.
Q: How can operators verify whether client isolation is enabled on their private APN?
A: Operators should request written configuration confirmation from their mobile carrier and conduct independent testing — CERT Polska recommends attempting communication between two devices on the same APN to verify that isolation is actually enforced.
The convergence of these two events — a government advisory and a conference disclosure separated by just ten days — delivers an unambiguous message to the industrial automation community. Architecture matters, but configuration matters more. In an era where PLCs are increasingly connected and adversaries are increasingly opportunistic, the gap between a security recommendation and its real-world implementation is where breaches are born.
