Six Utility Breaches Since December Show the Same Gaps: Default Passwords, No Segmentation, No Visibility

The Municipal Water Authority of Aliquippa, Pennsylvania was compromised because a Unitronics Vision Series PLC sat exposed to the public internet with the manufacturer's default password still set to 1111, according to a joint CISA, FBI and NSA advisory published December 1, 2023. Four months later, Mandiant reported that a Russian GRU-linked group manipulated a human-machine interface at a water tower in Muleshoe, Texas, causing the tank to overflow. The entry point, per Mandiant's April 17, 2024 report, was the same category of low-sophistication, internet-facing control system.

Those are not isolated incidents. Across five documents published by federal agencies and a private threat intelligence firm between December 2023 and May 2024, several water and energy sector compromises share a common root: default credentials, missing network segmentation, or no visibility into operational technology at all. None involved novel malware. All of them involved systems that had been exposed the same way for years.

The EPA's own inspection numbers

The scale behind these incidents comes from the regulator, not the attackers. In an enforcement alert dated May 20, 2024, the EPA reported that more than 70% of water systems it inspected since September 2023 failed to meet basic requirements under the Safe Drinking Water Act. The agency named the specific failures: unchanged default passwords, easily guessed credentials, and former employees retaining system access. The EPA announced it would increase inspections and pursue enforcement, including criminal penalties, against utilities that fail to secure OT networks.

That inspection figure frames every incident that follows. When Iranian-linked "Cyber Av3ngers" defaced the Aliquippa HMI, they did not need to breach a firewall or escalate privileges. The CISA advisory states plainly that the device was internet-facing with its factory password intact. The attackers never reached water treatment logic, and the utility shifted to manual operations, but the compromise took minutes, not months.

State actors are using the same gaps as criminal crews

The most consequential document in this set is CISA's February 7, 2024 advisory on Volt Typhoon, the Chinese state-sponsored campaign that has maintained persistent access inside U.S. energy, water and communications networks for, in the agency's words, "at least five years." CISA's advisory is explicit that the group relies on living-off-the-land techniques, exploiting valid accounts and legacy vulnerabilities rather than deploying novel tooling. The agency specifically flags small municipal providers as the highest-risk targets, because they lack the staffing to monitor the slow, subtle lateral movement these campaigns depend on.

Ransomware found the same seams

Ransomware operators arrived at the identical conclusion independently. Dragos's 2023 OT Cybersecurity Year in Review, published February 21, 2024, found that ransomware caused 70% of all OT-related cyber incidents that year, with a marked increase in targeting of the water sector. The same report found that 80% of Dragos's service engagements uncovered a lack of visibility into OT networks as the primary gap, and it noted that many municipal utilities still rely on "security by obscurity" for legacy PLCs that have since been connected to the internet, often without anyone tracking the change.

None of these incidents required an attacker to develop custom exploit code. Sandworm manipulated an HMI directly. Cyber Av3ngers typed a factory-default password. Volt Typhoon used valid accounts. Ransomware crews hit the IT side of utilities that had never separated it from OT. The skill ceiling for breaching a municipal utility, on this evidence, is low — and the EPA's 70% noncompliance figure suggests the opportunity is not shrinking.

What that means for procurement, not just patching

The persistent thread across these cases is staffing and procurement, not attacker sophistication. CISA's own Volt Typhoon advisory names the staffing gap directly, and Dragos's visibility figure says the same thing in operational terms: most of these utilities cannot see what is happening on their OT networks, let alone detect slow, living-off-the-land lateral movement. Fixing that is a budgeting and hiring problem before it is a tooling problem.

Three things in a utility's vendor ecosystem are worth checking against this record now.

• Default-credential status on any internet-facing PLC or HMI from a vendor named in a federal advisory. Unitronics devices were the entry point at Aliquippa specifically because the factory password was never changed after deployment.
• Segmentation between billing/administrative networks and OT control systems, especially at dual-service utilities.
• OT network visibility coverage, measured against Dragos's finding that 80% of engagements found none. A utility that cannot answer what traffic is traversing its OT network cannot detect the kind of persistence CISA attributes to Volt Typhoon, which by the advisory's own account has gone undetected in parts of U.S. infrastructure for half a decade.

The EPA's enforcement alert raises the possibility of criminal penalties for utilities that ignore these gaps after inspection. Given how many of the incidents above trace back to a password that was never changed, that threat is aimed at exactly the right target.

Links Verified at Time of Publish.

Sources

This article was reported from the following sources.

1. APT44: Unmasking Sandworm — Mandiant / Google Cloud, 2024-04-17
2. IRGC-Affiliated Cyber Actors Exploit Programmable Logic Controllers in Multiple States — CISA / FBI / NSA, 2023-12-01
3. PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure — CISA, 2024-02-07
4. EPA Takes Action to Protect the Nation's Drinking Water Systems from Cyberattacks — U.S. EPA, 2024-05-20
5. 2023 OT Cybersecurity Year in Review — Dragos, 2024-02-21