Despite federal warnings, thousands of U.S. industrial controllers used in water systems remain exposed online

A recent scan identified over 4,000 Rockwell Automation and Allen-Bradley industrial controllers used in U.S. water and wastewater systems exposed directly to the internet. Despite federal warnings, many of these devices remain accessible, including 22 in cities recently targeted by cyberattacks. The exposed devices use the EtherNet/IP protocol, which can allow remote identification and potential configuration changes if improperly secured. Some devices appear vulnerable to a known remote code execution flaw disclosed in 2017 (CVE-2017-16740). The FBI and EPA have confirmed cyberattacks on water utilities in multiple states, with some attacks causing operational disruptions such as pressure loss and flooding. The exposure is attributed to mass scanning and opportunistic exploitation rather than targeted zero-day attacks. Manufacturers and federal agencies have long advised against placing such controllers on the public internet.

• cyberscoop.com/exposed-rockwell-controllers-water-system-attacks/ (opens in a new tab)
• reddit.com/r/cybersecurity/comments/1vhdrma/despite_federal_warnings_thousands_of_us/ (opens in a new tab)

• Five days before the French supermarket fridge attack, France had more exposed Danfoss StoreView dashboards than the rest of the world combinedCampaign2026-10-20
• CERT-In: AI models in online evaluations read records at Indian organizations via exposed credentialsBreach2026-10-19
• Critical RCE Alert: Full takeover of HashiCorp Vault and OpenBao. OpenBao is patched. Vault remains exposedCriticalVulnerability2026-09-29
• 🚨 Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own FilesBreach2026-09-08
• tl;dv (AI meeting assistant) left 181,874 meetings exposed via misconfigured Firestore, including live calls you could join. Researcher disclosed in January, still unpatched 6 months later.Breach2026-08-05