The SCADA Perimeter Is a Firewall, a Vendor Login and a Default Password

Control-room security is usually drawn as a set of layers around the SCADA servers. The incidents and warnings of the past few months describe something less tidy: attackers who never touch the control room's front door, because a firewall login, a vendor account or an unchanged default password gets them to the field devices first. This week's advisories make that pattern hard to ignore.

A credential campaign aimed at the gateway

On 9 October 2026, the FBI and US Secret Service warned that a campaign known as FortiBleed is targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways, according to Industrial Cyber. The campaign exploits reused or leaked credentials and weak legacy password storage, and attackers keep scanning exposed devices with credentials they already hold. The agencies cited SOCRadar's verification of more than 86,644 compromised devices across 194 countries, and said the advisory applies to all 16 US critical infrastructure sectors, including energy and water.

Once inside, attackers can delete accounts or change passwords to lock legitimate users out, create new administrator accounts, explore the network and sell access. The agencies tied the activity to ransomware affiliates named INC/Lynx and Payload. The recommended steps are practical: remove internet-facing administration, end all active administrative and VPN sessions, reset passwords, require phishing-resistant multi-factor authentication, check for unrecognised accounts and compare configurations against a known-good baseline.

Poland showed where that path can lead

The same device family featured in an earlier grid incident. In February 2026, Cybersecurity Dive reported that CISA issued an alert about an attack on Poland's energy sector in December 2025, including wind and solar farms. Attackers got in through internet-facing FortiGate devices that lacked multi-factor authentication, likely using reused passwords. From there they used accounts with default credentials to reach the OT control devices, and all affected devices used default passwords.

The attackers deployed wiper malware that damaged operational technology, corrupted firmware and altered firewall rules. Renewable plants kept producing power, but the operator lost the ability to monitor or control them. CISA's lessons were direct: edge devices stay a persistent weak point, default passwords must be changed immediately, integrators and OT suppliers should be required to enforce password changes, and firmware verification should be switched on.

The vendor-access blind spot

Edge devices are one route; supplier connections are another. A global survey of 2,000 business and technology leaders across 16 industries, reported by Industrial Cyber on 8 October, found that 58% said a cyberattack had affected their operational environments in the past 12 months. Downtime was the most cited impact at 43%, followed by safety incidents at 40%. The average financial loss was reported as $1.04 million per operational incident.

On third parties, 49% said they monitor supplier connections only partially or not at all. Unmonitored third-party access and insecure vendor access were each cited as top concerns (27% and 26%). On AI, 70% said they use it in operational environments and 40% said it introduced new cybersecurity, compliance or operational risks. The survey covers many industries and gives no utility-specific figures, so it is a signal rather than a measure of the power sector.

Isolation as a design requirement

A joint guidance document published on 28 July 2026 by CISA, Australia's ASD, the UK's NCSC and Canada's cyber centre, CI Fortify: Advice for Isolating Vital Systems, asks operators to identify key assets, map how they connect and build separation points so essential functions continue through a serious incident. Operators should be ready to run independently for long periods and keep services going under degraded conditions through manual or alternative SCADA paths, with graduated isolation plans that are tested regularly.

What it means for utilities

For Indian utilities, the timing matters. SolarQuarter's summary of the CEA Cyber Security in Power Sector Regulations says mandatory provisions take full effect on 1 April 2027, with cyber incidents reportable to CSIRT-Power within six hours and critical operational data held in India.

Five steps follow from the evidence above.

First, inventory every internet-facing management interface. Firewalls, VPN gateways and remote-access portals should have no exposed administration, and each should have multi-factor authentication.

Second, find and remove default credentials in OT. RTUs, gateways, HMIs and wireless links installed by integrators are the likeliest to still carry them, and contracts should oblige suppliers to enforce changes.

Third, treat vendor access as a monitored asset. Every supplier connection needs an owner, an approval path, session logging and an expiry date.

Fourth, rehearse isolation. Decide which links can be cut, how the control room operates without them, and who has the authority to pull the switch. A six-hour reporting window leaves little time to design this during an incident.

Fifth, keep recovery material offline. Known-good configurations, firmware and passwords are needed if a wiper or lockout hits.

Key takeaways

• A credential campaign targeting Fortinet gateways, with more than 86,644 compromised devices reported, applies to energy and water operators.
• In the Poland grid attack, edge devices without MFA and OT devices with default passwords gave attackers a path to firmware and wiper damage.
• In a 2,000-leader cross-industry survey, 49% monitor third-party connections only partially or not at all.
• Joint guidance asks operators to map connections, build separation points and test isolation, including manual or alternative SCADA paths.
• India's CEA rules take full effect on 1 April 2027, with a six-hour incident-reporting window.

Sources

• FBI, Secret Service urge critical infrastructure operators to secure Fortinet gateways against FortiBleed attacks (Industrial Cyber)
• Claroty finds 58% of CPS operators faced operational cyberattacks as third-party access and AI risks grow (Industrial Cyber)
• CISA warns critical infrastructure operators after Poland energy hack (Cybersecurity Dive)
• CISA joins Australia and others to publish guidance to isolate operational technology (CISA)
• CEA Cyber Security Regulations 2026 Set New Power Sector Protection Standards (SolarQuarter)