OT Cybersecurity: What Recent Water System Attacks Teach Businesses
Recent water system cyberattacks across the United States have exposed a cybersecurity problem that extends far beyond public utilities.
More than 30 community water systems in Minnesota were targeted in a coordinated attack in late July, with attackers going after operational technology used to monitor and control physical water systems. Reports of attacks later expanded beyond Minnesota, raising a much bigger question for business leaders:
What is connected to your network that nobody is really watching?
TL;DR
Recent cyberattacks targeted operational technology at more than 30 Minnesota water systems, with similar activity reported across multiple states.
The bigger business risk is not limited to utilities. Manufacturing equipment, cameras, HVAC, access controls, IoT devices and vendor-managed systems can create overlooked paths into your network.
Businesses should know what's connected, restrict unnecessary internet and vendor access, segment critical systems and continuously identify vulnerabilities before they disrupt operations.
What Happened in the Recent Water System Cyberattacks?
On July 26 and 27, attackers targeted more than 30 Minnesota community water systems, focusing on Operational Technology (OT) rather than traditional business systems.
The attackers gained access to internet-connected Programmable Logic Controllers (PLCs)—devices used to control equipment such as pumps and valves. Federal warnings have identified exposed PLCs from manufacturers including Rockwell Automation, Siemens and Schneider Electric as potential targets.
Weak security practices made these systems easier to compromise. Some equipment was accessible from the public internet through cellular connections, and poorly protected credentials increased the risk. Once inside, attackers changed device IP addresses and administrative passwords, disrupting operators' ability to monitor and control equipment.
In Braham, Minnesota, the attack temporarily took the water plant's automated systems offline before crews restored operations.
Authorities have also investigated possible links to Iranian-affiliated threat actors, although public attribution has not been definitive.
For business leaders, the bigger lesson isn't really about water. It's about everything connected to your network that you may not think of as IT.
When Connected Technology Becomes a Business Risk
Most organizations have become dramatically more dependent on connected technology. Servers, laptops, cloud applications and Microsoft 365 are obvious parts of the IT environment.
Look deeper into the average manufacturing facility, warehouse, healthcare organization or commercial building, however, and you'll often find another layer of technology quietly operating in the background:
Manufacturing equipment. Building controls. Security cameras. Door-access systems. HVAC systems. Warehouse equipment. Environmental controls. Sensors. Programmable logic controllers. Vendor-managed equipment. Internet of Things devices.
Many of these systems fall under the category of operational technology, or OT.
Unlike traditional IT systems, their primary purpose isn't storing or processing information. They monitor or control something happening in the physical world.
And increasingly, they're connected to networks and the internet.
That connectivity has enormous benefits. Equipment can be monitored remotely. Vendors can troubleshoot without traveling onsite. Facilities can be centrally managed. Production systems can communicate with business applications.
But those connections can also create another potential path into your organization.
CISA's Internet Exposure Reduction Guidance specifically warns about the growing number of internet-accessible industrial IoT devices, SCADA environments, industrial control systems and remote-access technologies. Misconfigured systems, default credentials and outdated software can leave organizations unnecessarily exposed.
The Question Every Business Should Be Asking
What is connected to your network that nobody is really watching?
For many organizations, answering that question is harder than it sounds. A piece of equipment may have been installed five or ten years ago. A vendor may have requested remote access during installation and nobody ever revisited it.
An IoT device could still be using its original credentials. An older system may no longer receive security updates. Production equipment may share network access with employee computers and business systems. A third-party vendor may have persistent remote access without anyone regularly reviewing when or how that access is being used.
The technology might work perfectly well from an operational standpoint. That doesn't mean it's secure.
This is why a comprehensive cybersecurity strategy needs to extend beyond traditional computers and servers. Organizations need visibility across users, devices, networks, applications, access points and the other connected technology their operations depend on.
Why OT Cybersecurity Matters Beyond Water Utilities
Imagine the same problem inside your own business. A cyberattack doesn't necessarily have to encrypt every server or steal sensitive data to create serious damage.
If attackers can disrupt technology supporting your physical operations, they could potentially interfere with production equipment, warehouse operations, building access, security systems, environmental controls or other critical processes.
For a manufacturer, that could mean production stops.
For a logistics company, warehouse or shipping operations could be interrupted.
For a healthcare organization, employees could lose access to systems they rely on to deliver care.
For almost any business, technology downtime quickly becomes business downtime.
That changes the cybersecurity conversation. Cybersecurity isn't just about protecting data anymore. It's about protecting operations.
And that's one reason cybersecurity and managed IT services increasingly need to work together. Security is stronger when organizations have ongoing visibility into their technology environment rather than treating cybersecurity as a separate project that gets reviewed once a year.
Four Questions Worth Asking About Your Environment
You don't need to operate a water plant to learn something from these attacks.
Start by asking:
1. What is actually connected to our network?
That includes more than computers and servers. Identify IoT devices, cameras, building systems, manufacturing equipment, appliances, vendor-installed technology and anything else communicating across your network.
2. What can be accessed remotely?
Understand which systems are internet-accessible and whether they genuinely need to be. Also identify who has remote access, including employees, technology providers and equipment vendors.
3. Are critical systems separated?
A compromised device shouldn't automatically provide an attacker with access to the rest of your business. CISA recommends network segmentation to help contain intrusions and specifically recommends maintaining separation between traditional IT and operational technology environments.
4. Are we continuously looking for vulnerabilities?
Technology environments change constantly. New devices are added, vendors change configurations, software becomes outdated and vulnerabilities are discovered.
Security can't be a one-time checklist. CISA recommends routinely assessing internet-accessible assets, removing unnecessary exposure, changing default passwords, maintaining security updates, using monitored remote access and implementing multifactor authentication where possible.
Start With Visibility
You can't protect equipment you don't know is connected. You can't secure remote access nobody remembers approving. And you can't manage vulnerabilities in systems nobody considers part of the cybersecurity program.
That is perhaps the biggest lesson from the recent water system cyberattacks.
The underlying risk isn't unique to critical infrastructure.
It exists anywhere businesses have connected technology, aging infrastructure, remote vendor access or operational systems that have gradually become part of the network.
For many SMBs, those environments have evolved over years without anyone stepping back to look at the entire picture. The goal isn't to disconnect every device or assume every connected system is dangerous. It's to be able to answer four basic questions:
What's connected? Why is it connected? Who can access it? How is it being protected?
Do You Know What's Exposed in Your Environment?
Don't wait for an incident to discover the gaps.
Hyopsys can help you take an objective look at your technology and cybersecurity environment to uncover vulnerabilities, internet-exposed systems, aging technology, insecure remote access, network segmentation gaps and unmanaged devices that could put your business at risk.
Our approach to cybersecurity goes beyond reacting to threats. We help businesses understand where their risks are, prioritize what actually needs attention and put the right protections in place to keep your people, systems and operations running.
Start with a cybersecurity vulnerability assessment.
We'll help you identify what's exposed, understand the potential business impact and develop a practical plan to close the gaps before they become an operational problem.
