A report from cybersecurity firm Forescout has identified 4,407 internet-facing Rockwell Automation programmable logic controllers (PLCs) distributed across the globe. According to The Hacker News, these devices were identified during a scan conducted on August 3, raising concerns regarding the security posture of critical infrastructure components.

Of the total number of exposed controllers, 2,844 are located within the United States. Perhaps more concerning to security analysts is the discovery of 22 internet-facing Rockwell PLCs specifically situated in municipalities that have recently experienced cyberattacks against their water utility systems. Forescout noted that 19 of these 22 devices were operating on the same mobile carrier network, suggesting a potential concentration point for potential unauthorized access.

While the presence of these controllers on the public internet is confirmed, the researchers were unable to verify if any of the identified units have been successfully compromised by threat actors. The data highlights a persistent challenge in securing industrial control systems, which were traditionally air-gapped but are increasingly connected to external networks.

Key Data Summary

Why It Matters

The exposure of industrial control systems (ICS) is a systemic risk for the manufacturing and utility sectors. When PLCs—which manage the physical processes of water treatment, power grids, or manufacturing lines—are accessible via the public internet, they become low-hanging fruit for automated scanning tools used by state-sponsored actors and cyber-extortionists. The correlation between the exposed devices and municipalities already targeted by attackers indicates that the digital perimeter of critical infrastructure remains porous. Organizations must prioritize the migration of these devices behind secure VPNs or zero-trust network access gateways to prevent future service disruptions.