Why Stolen Logins Keep Opening the Door to Power Grids and Water Plants

Key points

• Most attacks on critical infrastructure start with stolen or reused passwords, not novel malware.
• Zero Trust, the security model that assumes no user or device is safe by default, is widely adopted for people but rarely enforced on the machines they use.
• Unmanaged contractor laptops are the weakest link in utilities, hospitals and transport networks.
• Specops Software, an identity-security vendor, argues that verifying the device is as important as verifying the human.
• Regulators including the US Cybersecurity and Infrastructure Security Agency (CISA) have repeatedly flagged credential theft as the top initial access route into operational technology.

The pattern behind most attacks on power plants and water utilities is boringly familiar. Someone logs in with a real username and a real password. The password was stolen or bought on a criminal forum. Nothing sophisticated happens until the intruder's already inside.

That's the point Specops Software makes in a new piece on identity gaps in critical infrastructure, flagged by BleepingComputer.

Why do stolen passwords still work so well?

Because most organisations trust a login once it succeeds. The system checks who you are. It doesn't check what you're logging in from.

An engineer at a water treatment plant might sign in from a company laptop on Monday and a personal home PC on Tuesday. The credentials work the same in both cases. If that home PC carries an infostealer, a small program that quietly copies saved passwords and session tokens, criminals get the same access the engineer has. The user is verified; the device is invisible to the system.

Our 14 July story on faked OAuth app IDs showed how attackers can now check stolen passwords without triggering a single sign-in alert, which makes the device-blind login an even easier target.

What Zero Trust is meant to do

Zero Trust is a security approach that treats every access request as hostile until proven otherwise. It grew out of frustration with old-style perimeter security, where being inside the firewall meant being trusted.

In practice, most Zero Trust rollouts focus on the human side: multi-factor authentication, which asks for a second proof such as a phone prompt, plus checks on sign-in location. Device health often gets left behind. A managed, patched work laptop is treated the same as a random home computer of unknown condition. For a bank, that's bad. For a utility running electricity substations, it's dangerous.

The contractor problem

Critical infrastructure runs on contractors: maintenance firms, software vendors, engineering consultants. Each has legitimate reasons to log in, often with privileged accounts, and each brings their own hardware.

Patching schedules vary. Endpoint protection may be years out of date. Stolen contractor credentials look identical to a genuine employee login.

CISA has warned repeatedly that valid accounts are the most common initial access route into industrial systems. The 2021 intrusion at the Oldsmar water plant in Florida and the 2023 attacks on US water utilities by an Iran-linked group both started with weak or exposed credentials, not zero-day exploits.

What device trust actually looks like

Specops and others argue for pairing every login with a real-time check on the machine itself. Known to the organisation? Operating system patched? Disk encryption active? Endpoint protection reporting in? If any answer is no, the login either fails or drops into a restricted session with no access to sensitive systems.

This matters most for remote access into operational technology, the specialised computers that control physical equipment like pumps and turbines.

Should you worry?

If your organisation grants remote access to contractors without checking device health, yes. Audit which accounts can reach operational systems, and from which devices. Require multi-factor authentication on every remote login, no exceptions for contractors. Block sign-ins from unmanaged or unhealthy devices for anything touching control systems. Check password databases against known breach lists so reused credentials get caught before an attacker uses them.

The honest read here is that none of this is new advice. What's new is that the threat end keeps getting cheaper and faster while the doing end stays stubbornly slow. Device trust isn't the glamorous half of Zero Trust, but it's the half that actually closes the door.