Over 4,400 Rockwell PLCs Exposed Online, 22 Found in Water Attack Cities

Over 4,400 Rockwell Automation PLCs were found directly accessible on the public internet, with 22 located in US water utilities that had already been targeted by cyberattacks. Industrial control systems like PLCs were never designed to be internet-facing, and exposing EtherNet/IP on port 44818 opens a direct path for attackers to manipulate physical processes — such as water treatment — without needing to breach a traditional IT network first. Attackers could have changed device IP addresses or set unauthorized passwords, effectively locking out legitimate operators and causing loss of visibility and control over critical infrastructure. This is especially alarming given the life-safety implications of compromised water systems. The presence of these devices on mobile carrier networks further complicates detection and remediation efforts.