First, the physical consequence: we're talking about loss of water supply to a city. According to the Polish ABW, attackers "gained access to ICS and obtained the ability to modify the operational parameters of equipment, creating a direct risk to operational continuity and the public water supply" at five water treatment stations. In August 2025, one incident "nearly caused a city to lose its water supply." That is not a cybersecurity incident anymore — that's a public health emergency. People need water to live. The blast radius here isn't stolen data or ransom payments; it's boil-water advisories, potential contamination events, and loss of public trust in essential services.
Attack vectors at small water utilities
According to the Polish ABW disclosure, the five breached facilities — Jabłonna Lacka, Szczytno, Małdyty, Tolkmicko, and Sierakowo — saw attackers gain access to industrial control systems with the ability to modify operational parameters. Let me map this to the Purdue model:
This is a Level 2/1 attack — the threat actors reached the SCADA/HMI layer and in some cases were positioned to affect Level 1 PLCs controlling pumps, valves, and chemical dosing. The ABW specifically notes attackers exploited "poorly secured industrial systems exposed to the internet, default credentials, and outdated configurations."
The specific vectors I see consistently:
Internet-exposed HMI/SCADA interfaces — Small utilities often have engineers who legitimate need remote access, but they lack the resources for proper VPN infrastructure, jump hosts, or Zero Trust architectures. So you get web-facing SCADA panels on port 80/443 with default passwords like "admin/admin" or "administrator/blank."
Supply chain credential theft — The ABW noted attackers "targeting supply chains specifically sought contract data, project documentation, and authentication credentials." This is the path of least resistance: why hack a PLC when you can steal the integrator's laptop with the project files and VPN credentials?
Default configurations on PLCs and RTUs — Small utilities run on razor-thin margins. They buy equipment, get it commissioned, and it runs for 15 years without firmware updates. Factory default passwords, unencrypted Modbus, Telnet instead of SSH — all present.
Purdue Level 3.5/DMZ gaps — Larger utilities have DMZs with data diodes and unidirectional gateways. Small utilities often have a firewall rule that "mostly works" between the enterprise LAN and the SCADA network. One compromised billing workstation becomes a beachhead to the SCADA.
Global parallels
This is not uniquely Polish. I see the exact same attack surface at small utilities in the US, EU, and elsewhere. A March 2026 Minot, North Dakota incident — ransomware on the SCADA system serving approximately 80,000 residents, forcing manual gauge monitoring to maintain water safety — is the same pattern. CISA, FBI, EPA, and NSA issued joint advisories on Iranian-affiliated cyber actors exploiting PLCs "in multiple sectors, including US water and wastewater systems facilities," with warnings of "continued malicious cyber activity" and specific TTPs targeting these operational environments.
The structural problem is universal: small municipal water systems lack dedicated OT cybersecurity staff. Their IT team handles email, billing, AND the SCADA. They have no air-gapped engineering network. They cannot afford the six-figure industrial firewalls and unidirectional gateways that large utilities deploy.
Actionable hardening for under-resourced operators
I am not going to tell a small water utility to "patch within 24 hours" or "deploy a full zero trust architecture." That is fantasy. Here is what is realistic:
Immediate (weeks, low cost):
- Change default credentials on every PLC, HMI, RTU, and network switch. Document them in an encrypted vault, not a spreadsheet on the operator's desktop.
- Disable internet exposure — No SCADA/HMI should be reachable from the public internet. Period. If remote access is needed, use a cellular modem with IP whitelisting and strong authentication, not a port forward on the main firewall.
- Inventory your Purdue Level 3.5 — Map exactly what can talk between your business network and your SCADA. Remove any "temporary" connections that became permanent.
Short-term (months, moderate cost):
- Network segmentation at Level 3 — Even a basic VLAN separation between business IT and OT networks with a properly configured firewall beats the flat network most small utilities run.
- Logging and monitoring — You do not need a SIEM. Even basic Windows Event Log forwarding and PLC connection logging will catch lateral movement.
Medium-term (annual planning cycle):
- Maintenance window planning — Identify critical firmware patches and schedule them during your planned plant shutdown. Have rollback procedures tested.
- Virtual patching — For vulnerabilities you cannot patch immediately, use network-layer controls to block exploit traffic.
The ABW disclosure is significant because it confirms what we have seen building: threat actors are moving from espionage to direct operational disruption at Level 1. The barrier to entry for these attacks has dropped. Small utilities are the soft target, and the physical consequences are the same whether the attacker is Russian state-backed, Iranian, or ransomware gangs.