What the Recent Water Systems Cyber Attacks Reveal About Critical Infrastructure Security

The recent cyber attacks targeting Minnesota and a dozen other U.S. states’ water utilities weren’t notable because attackers used new techniques. They were a reminder that familiar methods can still disrupt critical infrastructure when they reach operational systems.

According to investigators, attackers targeted programmable logic controllers (PLCs), changing passwords to lock operators out of systems. The attacks forced some communities to issue boil-water notices and operate manually while restoring access.

The incident highlights an enduring challenge for critical infrastructure organizations. As operational technology becomes more connected to enterprise networks, cloud services, remote access, and identity platforms, the opportunities for attackers expand. Organizations don’t just need to reduce exposure, but they also need confidence that their people can identify attack paths, recognize suspicious activity, and respond before disruption occurs.

As critical infrastructure organizations modernize, the boundary between enterprise and operational systems becomes less distinct. Sensitive equipment and data can be exposed via:

• Public-facing services
• Identity platforms
• Corporate workstations
• Vendor connections
• SCADA servers
• PLC management stations

Attackers don’t need a sophisticated exploit developed for an industrial controller. Access can begin with an internet-exposed service, a stolen or default credential, an improperly secured remote connection, or a common configuration weakness. 

The recent activity makes the consequences of that connectivity clear. Changing passwords and locking operators out are not novel techniques. Against systems involved in delivering an essential service, however, familiar methods can create a serious operational problem.

Cybersecurity coverage often focuses on what is unprecedented: a new vulnerability, an unknown threat actor, or a technique that has not been documented before. Those developments matter, but novelty does not determine impact.

Critical infrastructure can be disrupted through weaknesses the security community has understood for years. Credential abuse, privilege escalation, lateral movement, and configuration changes are common elements of attacks across many sectors. Their significance changes when the systems involved control water treatment, electricity generation, or other operations that affect daily life.

Organizations should not base readiness only on tracking the latest threat. They must know whether established security practices work across environments that may change faster than their policies and assumptions.

Following the initial Minnesota attacks, CISA urged water utilities to disconnect PLCs from the internet and to place required remote access behind a VPN or gateway device. Reducing direct exposure is an important first step, but defending operational environments requires several controls working together.

Organizations should also:

• Identify exposed assets and remove unnecessary internet access.
• Test segmentation between corporate IT and OT systems.
• Monitor for suspicious authentication, configuration changes, and lateral movement toward OT.

Most of these recommendations are well established. The harder question is whether teams can apply them when an attacker is already moving through a complex environment. 

That work is difficult to learn through isolated exercises. Real attacks do not present vulnerabilities in a prescribed order or tell defenders which alert matters most. 

Training for critical infrastructure should reflect that complexity. Practitioners need opportunities to work across a complete attack path: assessing exposed services, testing identity controls, navigating segmented networks, recognizing the transition from IT to OT, and understanding the operational consequence at the end. They must learn how an attacker thinks while also developing the judgment required to defend environments where availability and safety affect every response decision.

For organizations, hands-on training provides more than technical development. It offers a way to evaluate whether teams can apply knowledge under pressure. These capabilities should be developed before an incident, not during one.

OffSec develops training around the systems and risks practitioners encounter in the field. DynamoDam simulates an attack against connected IT and OT infrastructure, including programmable logic controllers (PLCs), SCADA systems, and technology controlling turbine operations. 

Like these recent water system incident, this lab demonstrates how access to PLC-related systems can allow familiar attack techniques to produce operational disruption.

For red teams, DynamoDam provides experience identifying and combining the weaknesses that can expose operational systems. Practitioners can carry that experience into assessments, helping organizations determine whether misconfigurations, weak segmentation, exposed services, or inadequate access controls could provide a similar route into their OT environments.

For defensive teams, working through the environment develops an offensive mindset. Understanding how an attacker discovers assets, moves between IT and OT, and approaches PLC and SCADA systems can help defenders recognize meaningful activity earlier, improve detection logic, and focus monitoring on the points where an attack can be interrupted.

DynamoDam is not a reconstruction of the Minnesota and related attacks, but it gives security teams a safe environment to examine the same underlying risk. It also creates a shared understanding of the attack path, helping red and blue teams work together to find weaknesses and strengthen defenses.

Every critical infrastructure incident provides new lessons, but organizational readiness cannot depend on reacting after the fact. Security teams need practical experience identifying attack paths, adapting to unfamiliar situations, and responding effectively as techniques, technologies, and threats evolve.

OffSec’s hands-on training reflects the vulnerabilities, technologies, and attack paths practitioners encounter in the field. Through realistic labs and cyber ranges, learners build the technical depth, adaptability, and adversarial mindset needed to recognize compromise, validate assumptions, and stop attacks before they become operational disruption.

The recent water system attacks are a reminder that familiar techniques can have serious consequences when they reach critical infrastructure. Preparing teams before the next incident is just as important as responding to the last one.

Access DynamoDam through Learn Enterprise, alongside OffSec’s full learning library, cyber ranges, CVE exploit labs, and guided learning paths designed to build practical offensive and defensive skills.

Prepare your team for real-world threats with Learn Enterprise.