4,400+ Rockwell PLCs Exposed Online; 22 Near Water Utility Attack Sites

Fri, 07 Aug 2026 00:21:58 +0000

Engineer — Plan: If your organization runs Rockwell Automation PLCs, verify none are internet-facing — Forescout’s scan found 2,844 exposed in the US alone. No exploitation confirmed, but the attack surface is substantial; audit firewall rules and mobile-carrier connections to any OT assets this quarter.
SOC/IR — Learn: The correlation of 22 internet-exposed Rockwell PLCs in water utility attack cities is noteworthy context, but no IOCs, TTPs, or detection opportunities are surfaced — file as threat-landscape awareness for critical infrastructure hunting programs.
Leader — Plan: The pattern of water utility cyberattacks combined with thousands of internet-exposed industrial controllers warrants adding OT/ICS internet exposure to your next risk review; if your organization operates critical infrastructure or uses Rockwell equipment, request an exposure audit before this becomes a board question.

Attack-Surface on CuraSec