4,407 Rockwell PLCs Sit on the Public Internet, 22 in Cities Hit by Water Utility Attacks
TL;DR what: Forescout's August 3 scan found 4,407 internet-facing Rockwell PLCs worldwide, including 22 in US cities where water utilities reported attacks since July 27. Forescout scanned the internet on August 3 and counted 4,407 exposed Rockwell Automation programmable logic controllers. 2,844 of them are in the United States. Twenty-two sit in cities where water utilities have reported…
Forescout's August 3 scan revealed a total of 4,407 Rockwell PLCs exposed to the public internet worldwide, with 2,844 located in the United States. Among these, 22 controllers are situated in cities that have reported water utility cyberattacks since July 27, with 19 of those 22 sharing the same mobile carrier network. However, Forescout was unable to determine if any of the 4,407 controllers were compromised. The total count pertains to the controllers themselves, not the utilities or victims affected.
The exposed controllers rely on EtherNet/IP on TCP port 44818. An unauthenticated connection to this port allows attackers to identify the device, including its vendor, product code, firmware revision, and possibly its project name. This feature enables mass scanning, as an attacker does not need to guess the targeted device; the device reveals the information itself.
Two independent scans conducted on July 30 and August 3 both identified approximately 4,100 exposed Rockwell/Allen-Bradley EtherNet/IP hosts, indicating a consistent scale.
Historically, the number of exposed controllers has significantly reduced from a peak of 7,814 in March 2020 to a June 2026 low of 4,169, representing a 47% decrease. However, the number has since stabilized. The MicroLogix 1400 and MicroLogix 1100 families account for 50% and 8% of the exposed controllers, respectively. Both models were specifically mentioned in FBI and EPA advisories.
It is concerning that 70% of the exposed US-based controllers are connected through large mobile carrier networks, such as Verizon Business, AT&T Mobility, and T-Mobile USA. This pattern is typical for remote sites lacking fiber connectivity, relying on cellular routers for SCADA polling and remote troubleshooting with publicly assigned IP addresses and no inbound traffic filtering.
The clustering of the 22 exposed controllers in affected cities on the same carrier network suggests a shared integrator, deployment template, or APN configuration, which could allow attackers to exploit a successful compromise across all customers sharing this vulnerable setup, as warned by the FBI. This shared configuration poses a significant risk, as a single integrator's default configuration can become a target list.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
