Denis Calderone, CTO, Suzu Labs:
“Default passwords on devices running unauthenticated protocols, sitting directly on the public internet, operated by staff who mistook active cyberattacks for normal equipment glitches. Every one of those problems traces back to the same root cause, that these systems were converged onto IP networks with zero defensive posture in mind. If anyone had architected even basic protections against internet-borne attack vectors when these HMIs and PLCs were networked, you wouldn’t see this kind of systemic exposure across five water treatment facilities in a single country.
“And this is not random opportunistic hacking. Poland’s internal security agency is describing what amounts to a sustained campaign against NATO critical infrastructure. The ABW report names Russian intelligence services as the driving force behind intensified cyber operations against Poland in 2024 and 2025, and these water attacks are part of a broader pattern that includes the national railway, air traffic control, and a foiled attempt to shut off water to one of Poland’s ten largest cities. The ABW opened 48 espionage investigations in 2025 alone, up from six the year Russia invaded Ukraine. Considering everything we’re seeing, this is not run-of-the-mill hacktivism. This is a coordinated intelligence operation with critical infrastructure as a central target.
“The prescriptive side here is not complicated. HMIs and SCADA interfaces need to come off the public internet, period. If remote access is operationally necessary, put it behind a VPN with multi-factor authentication, not directly reachable on the open web. Segment OT networks from IT networks with monitored firewall boundaries. CISA and the EPA published a joint fact sheet in December 2024 specifically about internet-exposed HMIs in water and wastewater systems, and it reads like a checklist written for exactly these incidents. And operators need to be trained to recognize that unexpected parameter changes might not be a glitch. If your pumps or alarms are behaving strangely and you can’t explain why, treat it as a potential intrusion until proven otherwise.”
Lydia Zhang, President & Co-Founder, Ridge Security Technology Inc.:
“Cyberattacks have evolved from stealing information, damaging reputations, and causing financial loss to the point where people are now asking whether cyberattacks could directly cost lives. We are getting closer to that reality.
“When it comes to critical infrastructure during wartime, more traditional approaches and operational discipline may prove more effective. This includes operating in air-gapped environments, enforcing strict personnel access controls, and strengthening external-facing interfaces such as websites and billing systems through layered protection and diligent security testing.”
