“Censys ARC identified 4,148 Internet-exposed hosts responding to EtherNet/IP”
Over four thousand Rockwell controllers and another four thousand Siemens S7-1200 units are answering on the open internet, with 71 percent of the Rockwell hosts in the United States. These are the boxes that run pumps and valves at municipal water plants. Attackers are already changing passwords and knocking devices offline. Every one of these should have been behind a VPN a decade ago, and the reason they are not is that small utilities have no security budget and no one is going to give them one.