Locking down remote water sites: a checklist for operators and managers.

Artek engineering team · October 2026

How a remote site gets reached from the internet

A remote site usually has three things that matter here: the PLC that runs the pumps and valves, an operator screen (HMI) if the site has one, and the cellular modem, radio or router that links it back to the plant. If the modem has a public IP address and forwards ports to the PLC or the screen, those devices answer anyone on the internet. So may the modem’s own setup page, if remote management is turned on.

Search tools scan public addresses for open ports around the clock, and federal agencies say exposed control devices are found quickly that way. The systems that were attacked used default or easily guessed passwords.¹ EPA and CISA say they regularly find exposed operator screens at water and wastewater systems. Whoever reaches one can see the screens, maps, event logs and security settings, and can change how the process runs.²

Factory passwords are published. CISA’s alert on the attacked Unitronics controllers named their default, 1111.³ In 2016, Canada’s federal cyber incident response center warned that the Mirai botnet could take over certain Sierra Wireless cellular gateways reachable from the internet by logging in with their published default credentials.⁴

EPA inspectors found the same gaps at some water systems in 2023 and 2024: default passwords never changed, one login shared by all staff, and former employees who still had access.⁵

What has already happened

In every case below, someone reached the system from the internet and the utility ran the site by hand afterward.

Aliquippa, Pennsylvania: November 2023

According to CISA, attackers likely got into a Unitronics Vision Series controller with a built-in operator screen at a U.S. water facility by taking advantage of poor password security and the device being exposed to the internet. CISA’s alert told owners to make sure the default password, 1111, was not in use. The utility took the system offline and switched to manual operations, and CISA said there was no known risk to drinking water.³ News reports identified the site as a booster station of the Municipal Water Authority of Aliquippa that regulates pressure for two townships.⁶

A joint advisory from CISA, the FBI, EPA and other agencies later described the wider campaign against these controllers: at least 75 devices compromised, at least 34 of them in the U.S. water and wastewater sector. The devices were connected to the internet and had either a default password or none. The attackers erased the original program on the controller and loaded their own.⁷

Muleshoe, Texas: January 2024

Hackers broke into a remote login system for the industrial software that operators use to run a water tank, the city manager told CNN. The tank overflowed for about 30 to 45 minutes before city officials took the system offline and switched to manual operations. The city replaced the software and took other steps to secure its network, and drinking water was not affected. In nearby Hale Center, after attempts to get through the town’s firewall, officials disabled remote access to their SCADA system. CNN’s reporting did not confirm who carried out the Muleshoe attack.⁸

Exposed operator screens: 2024 and 2025

In December 2024, EPA and CISA described attacks on operator screens left exposed to the internet at water and wastewater systems. The attackers pushed setpoints to their maximum, changed other settings, turned off alarms and changed administrative passwords to lock operators out. Pumps and blowers ran past their normal operating limits, and the utilities had to switch to manual operations.²

A December 2025 advisory from U.S. and international agencies described the same pattern. Attackers reached operator screens through remote-screen software (VNC) open to the internet, logged in with default or weak passwords, changed setpoints and cleared the alarms their changes caused. Water and wastewater was one of the targeted sectors. The most common impact was a temporary loss of view that required staff to run the process by hand.⁹

Nine checks for every remote site

Several of these depend on settings made at installation, so work through them with your integrator or vendor.^1,2,10

1. Find what can be reached from the internet. List every remote site and how it connects back: cellular modem, radio, DSL or fiber. For each one, find out whether the PLC, the operator screen, the modem’s setup page or any remote-screen software answers from the internet. Also list every remote-access tool that connects out from a site or the SCADA computer, such as TeamViewer, AnyDesk, or a modem or PLC maker’s cloud portal; an outside scan will not find these. CISA scans water utilities for free: email vulnerability@cisa.dhs.gov, and include the public addresses your carrier assigned to your modems, not just your office connection.² Disconnect anything that answers and does not need to.
2. Change every default password. That includes PLCs, operator screens, modems, routers and remote-screen software. Use a different strong password on each device and keep them in a password manager your supervisors can open, not a spreadsheet on the SCADA PC. Give each person their own login at the VPN, jump host and SCADA system, and remove it when they leave. Many PLCs and modems allow only one password; change it whenever someone who knew it leaves.^1,5
3. Allow remote access only through a VPN or a jump host, with multifactor authentication. No PLC, screen or modem should be reachable on its own. Staff and vendors connect to one secured entry point, confirm who they are with a second factor (CISA recommends one that resists phishing), and only then reach the site.^1,2 This applies to the SCADA system’s own polling too. If sites report over cellular, either get a private APN from your carrier (a private cellular network with no public addresses, linked to your plant) or have each modem open an encrypted VPN tunnel out to the plant, so nothing at the site accepts connections from the internet. Keep the VPN device updated; it is now the only way in from the internet. On a system we built for a groundwater consultancy, field sites connect over VPN to Ignition in a private AWS network.
4. Accept connections only from known addresses. Set the firewall or VPN to allow only the addresses that should connect, such as your plant and your integrator’s office.^2,3 For an irrigation water authority, we recommended a reverse proxy with TLS, an IP allow-list and firewall rules that reach only the proxy, planned with their IT and network security staff.
5. Turn off services you do not use, and keep firmware current. Every service a device runs is another way in. Update firmware on PLCs, screens, modems and VPN devices, starting with anything that faces the internet.^2,10 CISA advised owners of the attacked controllers to move off the default port, TCP 20256,³ but the 2025 attackers searched the default VNC port, 5900, and the ports near it,⁹ so a moved port is a minor extra, never a substitute for a VPN and a password. Moving Modbus or DNP3 off their standard ports also breaks polling on many devices.
6. Limit setpoints in the PLC, and alarm on what the site is doing. The 2024 attacks pushed setpoints to their maximum, turned off alarms and changed passwords.² Put high and low limits on every setpoint in the PLC, not only on the screen, so an out-of-range value is refused. Have the central SCADA system alarm on what the site is doing, not only on the site’s own alarms: level, pressure or pump run time outside its normal range, and loss of communication. Those still fire if someone turns off alarms at the site. Have the VPN alert on logins from an unexpected account, place or time, and send all of it to someone who will see it at night.
7. Log every remote session. Record who connected, when, from where and what they changed, including vendor and integrator sessions. Check failed logins and connections at unusual hours.² Keep the logs on a separate system so they survive if a device is wiped.
8. Back up PLC programs and settings. Keep a current copy of every PLC program, operator screen project and modem or router configuration, with one copy stored offline. In the 2023 attacks on Unitronics controllers, the program on the controller was erased,⁷ and a backup is what lets you load it again. Test a restore before you need one.^3,10 Where a PLC has a RUN/PROGRAM key switch, leave it in RUN so a remote connection cannot load a new program.
9. Plan for running every site by hand. Every incident above ended with staff operating the system manually. For each site, write down who goes, what they check, how to run the pumps locally and how long the site can hold before it overflows or loses pressure. Then ask your crew: if remote access went down tonight, which sites could we run by hand, and for how long? Practice it.¹

What to ask your integrator or vendor

The federal agencies note that weak settings can come from the integrator, a service provider or the product’s factory defaults.¹

• Which of our devices can be reached from the internet today, and how did you check?
• Which devices still have a factory default password, and who holds the current passwords?
• How do you connect to our system remotely? Does every session go through our VPN or jump host with multifactor authentication, and is it logged?
• Does each of your technicians have their own login, and how do we remove one?
• Where are the current backups of our PLC programs, operator screens and modem settings, and when was a restore last tested?
• What firmware is each PLC, screen and modem running, and are updates available?³
• What alarm or log entry would tell us that a setpoint was changed remotely?

How we build remote access

On the water systems we build, no gateway sits on the open internet, field sites connect over VPN, and we keep a written list of every path into the control network. If you run Ignition, the free Ignition MRI checks the gateway’s own security settings from one backup.

Sources

1. CISA, FBI, EPA and Department of Energy, Primary Mitigations to Reduce Cyber Threats to Operational Technology, fact sheet, May 6, 2025.
2. EPA and CISA, Internet-Exposed HMIs Pose Cybersecurity Risks to Water and Wastewater Systems, fact sheet, December 13, 2024.
3. CISA, Exploitation of Unitronics PLCs used in Water and Wastewater Systems, alert, November 28, 2023, updated December 19, 2023.
4. Canadian Cyber Incident Response Centre (CCIRC); alert now hosted by the Canadian Centre for Cyber Security, Alert AL16-018 on default credentials in some Sierra Wireless devices, October 14, 2016.
5. EPA, Enforcement Alert: Drinking Water Systems to Address Cybersecurity Vulnerabilities, May 2024.
6. CBS News Pittsburgh, Municipal Water Authority of Aliquippa hacked by Iranian-backed cyber group, November 26, 2023.
7. CISA, FBI, NSA, EPA and partner agencies, IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities, advisory AA23-335A, December 1, 2023, revised December 18, 2024.
8. CNN, Russia-linked hacking group suspected of carrying out cyberattack on Texas water facility, cybersecurity firm says, April 17, 2024.
9. FBI, CISA, NSA and partner agencies, Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure, advisory AA25-343A, December 9, 2025.
10. CISA, EPA and FBI, Top Cyber Actions for Securing Water Systems, fact sheet, February 2024.