Nobody Owns the Factory Setting

Beginning on July 27, water and wastewater utilities in at least seven states started reporting the same thing to the FBI. Someone had reached into the small industrial controllers that run their pumps and valves, changed the passwords and the network addresses, and locked operators out of their own monitoring and control. At least one utility noticed discrepancies across several sites and found that the programs running its controllers had been modified.

The door was already open. According to NIST, the attackers reached controllers sitting on the public internet “with poor security configurations.” This is less a story about a clever adversary than about the door. The door is a setting that every party in the chain had a good reason to believe was somebody else’s responsibility.

Seven states, one kind of door

The FBI and the EPA issued a joint warning on July 30. It names the equipment, Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400 controllers, and it describes the effect plainly: the attackers “changed the IP addresses and passwords, resulting in a loss of monitoring and control functionality.” Its fuller account is sharper: the attackers were “turning on and setting passwords.” A password someone else can turn on is one that was never set in the first place. It reports that “operational effects reported to the FBI have included loss of pressure and flooding,” and notes that pressure loss in a water system could let untreated groundwater seep into the pipes. The warning names no threat actor, and I am not going to supply one.

On October 1, NIST’s cybersecurity team, writing with MITRE, published its own reading of the same events. Its list of how these risks get in is short and ordinary: “outdated firmware, use of credential sharing or default passwords, misconfigured settings, or unpatched software.” The federal warning’s instruction is just as ordinary. Disconnect the controller from the public internet.

Here is the precision that matters. Neither document says a default password was the way in this summer. They describe internet-facing controllers with weak configurations. That is the same category of door, and this sector has been shown that door before.

We have been here before, and it was written down

In late November 2023, attackers reached a Unitronics controller at a booster station run by the Municipal Water Authority of Aliquippa, in western Pennsylvania. The authority said there was no known risk to the drinking water. Three days later, CISA issued an alert on the exploitation of Unitronics controllers in water and wastewater systems. It cites “poor password security and exposure to the internet,” and its instruction to every operator running that equipment could not be plainer: “Ensure the Unitronics PLC default password ‘1111’ is not in use.” On December 1, federal agencies attributed the intrusions to a group affiliated with Iran’s Revolutionary Guard, which said it targeted the equipment because it was made in Israel. The way in was ordinary: internet-connected controllers with the default password or no password at all.

On December 15, CISA published a Secure by Design alert aimed not at utilities but at the companies that build the technology. Its central sentence was unusually blunt for a federal agency: “The use of widely known default passwords is unacceptable given the current threat environment.” It asked manufacturers to ship setup passwords unique to each device, or ones that disable themselves once setup is complete.

Nearly three years later, the sector’s advisories are again telling operators to change passwords and take controllers off the internet. Nobody in that chain was careless in a way they could see from where they sat. That is what makes it worth an edition.

Three reasonable assumptions, one setting

Follow a single controller from the factory to the treatment plant and ask who could have owned its configuration.

The manufacturer ships it with a credential that makes first setup possible. That is a reasonable design choice, and the assumption behind it is reasonable too: the customer will change it.

The integrator, the contractor who installs and programs the system, is paid to make the plant work. Remote access makes it serviceable. The assumption is that the owner’s security policy governs what happens next. The FBI saw where that leads: across several victims, it found “similarities in network setup provided by third parties.” Standardizing is how an integrator keeps many plants serviceable. It is also how an attacker turns one success into several. Physical security learned this long ago. If you know how many guards a building has, where they stand and when they take lunch, you do not need to be clever to get in.

The utility runs it. NIST counts nearly 50,000 community water systems and more than 16,000 wastewater systems in the United States, and more than 80% of utilities are small ones serving 3,300 people or fewer. The assumption, for a plant that size, is that the vendor set it up right.

Each of those assumptions is understandable from where that party sits. CISA has already ruled out the manufacturer’s. Put them together and the setting has three possible owners, and nobody can name which one it actually is. Call it the orphaned setting: a configuration everyone in the chain can see, and nobody in the chain decided.

The orphaned setting is not a security failure in the usual sense. Nobody chose weak security. Nobody chose anything. The default persisted because persisting is what a default does when no one is assigned to change it.

NIST already wrote the diagnosis

The most important sentence in NIST’s October 1 post is not about attackers at all. “OT operators cannot protect what they do not know about.” NIST is opening a new project on OT asset management and visibility for exactly that reason, covering discovery, inventory, configuration and change management: the unglamorous record of what is connected and how it is set.

That sentence is the ownership argument in one line. You cannot assign an owner to a setting on a device you do not know is reachable. Inventory is not a security chore that comes after governance. It is the precondition for anyone being able to say “that one is mine.”

The same setting is shipping again

Nothing in this summer’s attacks involved AI. I want to be precise about that, because the parallel here is structural, not technical.

The AI equivalent of the controller is the connector, the server that lets an AI agent reach a database, a file system or a business application. Organizations are wiring these up now, quickly, through the Model Context Protocol. In April, Trend Micro researchers reported finding 1,467 MCP servers exposed to the internet, nearly three times the 492 they had found in July 2025, which ran with “no client authentication or traffic encryption.” Among the newer set were 70 hosts offering a tool that runs database queries, and at least three with access to patient medical records. Their own summary: “the default-open nature of many MCP servers is a major security risk.”

Read the chain again. A framework ships with a default that makes the first demo work. A developer wires it up, because the job is to make the agent useful. The business runs it on the assumption that someone set it up right. Three reasonable assumptions, one setting, and nobody’s name on it.

The water sector took years to travel from Aliquippa to the reference guide NIST finalized this June on securing remote access to these systems. AI connectors are at the start of the same road. The AI side has it easier: a connector is software, and authentication can be added this week. A controller at a pump station may stay in service for decades. Nobody has to wait for the advisory.

What this does not claim

This edition does not claim that default passwords were how this summer’s attackers got in. The federal documents describe internet-facing controllers with weak configurations and say no more than that. It does not connect this summer’s attacks to the 2023 campaign. The 2026 warning names no actor, and this edition will not speculate. It does not claim the controllers named in that warning are defective, and the warning’s own advice is to take them off the public internet and plan for replacing devices at end of life. It does not claim AI played any role in what happened to the water sector. The connection drawn here is about who owns a configuration, not about any technology used in the attacks.

So own it

The question for a leadership team is not whether the security group is good. It is whether anyone owns the settings nobody chose.

The federal warning’s own fixes are settings too: put a gateway in front of the controllers, and leave them in RUN unless someone is making a change on purpose.

Two questions, both free to ask. Which of our systems, including the AI connectors we stood up this year, can be reached from the internet, and who decided that? And for every default still in place, whose name is on the decision to keep it?

If the answer to either is “it came that way,” you have found an orphaned setting. Give it an owner. That is where the fix starts.

Sources

NIST Cybersecurity Insights: https://www.nist.gov/blogs/cybersecurity-insights/securing-water-and-wastewater-operational-technology-environments Title: “Securing Water and Wastewater Operational Technology Environments.” Authors: CheeYee Tang (NIST), Robert Stea and John Wiltberger (MITRE). Published October 1, 2026.

FBI and EPA: https://www.ic3.gov/PSA/2026/PSA260730.pdf Public Service Announcement I-073026-PSA, “Malicious Cyber Actors Targeting Water and Wastewater Sector Internet-Facing Programmable Logic Controllers, Causing Operational Disruptions.” Published July 30, 2026.

NIST National Cybersecurity Center of Excellence: https://csrc.nist.gov/News/2026/cyber-for-water-wastewater-sector NIST SP 1800-45, “Cybersecurity for the Water and Wastewater Sector: Build Architecture.” Final version announced June 24, 2026.

CISA: https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems Title: “Exploitation of Unitronics PLCs used in Water and Wastewater Systems.” Published November 28, 2023, updated December 19, 2023.

CISA: https://www.cisa.gov/sites/default/files/2023-12/SbD-Alert-How-Software-Manufacturers-Can-Protect-Customers-by-Eliminating-Default-Passwords-508c_0.pdf Title: “Secure by Design Alert: How Software Manufacturers Can Protect Customers by Eliminating Default Passwords.” December 15, 2023.

CBS News Pittsburgh: https://www.cbsnews.com/pittsburgh/news/municipal-water-authority-of-aliquippa-hacked-iranian-backed-cyber-group/ Title: “Municipal Water Authority of Aliquippa hacked by Iranian-backed cyber group.” November 26, 2023.

Trend Micro: https://www.trendaisecurity.com/en/resources-insights/deep-research/update-on-exposed-mcp-servers-the-threat-widens-to-the-cloud Title: “Update on Exposed MCP Servers: The Threat Widens to the Cloud.” Authors: Alfredo Oliveira and David Fiser. Published April 28, 2026.

FBI, CISA, NSA, EPA and the Israel National Cyber Directorate: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a Joint Cybersecurity Advisory AA23-335A, “IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities.” Published December 1, 2023, updated December 18, 2024.