Why Stolen Logins Keep Opening the Door to Power Grids and Water Plants

Key points

• Most attacks on critical infrastructure start with stolen or reused passwords, not novel malware.
• Zero Trust, the security model that assumes no user or device is safe by default, is widely adopted for people but rarely enforced on the machines they use.
• Contractors, remote workers and unmanaged laptops are the weakest link in utilities, hospitals and transport networks.
• Specops Software, an identity-security vendor, argues that verifying the device is as important as verifying the human.
• Regulators including the US Cybersecurity and Infrastructure Security Agency (CISA) have repeatedly flagged credential theft as the top initial access route into operational technology.

The pattern behind most attacks on power plants, water utilities and hospitals is boringly familiar. Someone logs in with a real username and a real password. The password was stolen, guessed, or bought on a criminal forum. Nothing sophisticated happens until the intruder is already inside.

That is the point Specops Software makes in a new piece on identity gaps in critical infrastructure, which was flagged by BleepingComputer.

Why do stolen passwords still work so well?

Because most organisations still trust a login once it succeeds. The system checks who you are. It rarely checks what you are logging in from.

An engineer at a water treatment plant might sign in from a company laptop on Monday and a personal home PC on Tuesday. The username and password work the same in both cases. If that home PC is infected with an infostealer, a small program that quietly copies saved passwords and session cookies, the criminals get the same access the engineer has.

This is the identity gap. The user is verified. The device is not.

What Zero Trust is meant to do

Zero Trust is a security approach that assumes every request is hostile until proven otherwise. It grew out of frustration with old-style network security, where being inside the firewall meant being trusted.

In practice, most Zero Trust rollouts focus on the human side: multi-factor authentication, which asks for a second proof such as a phone prompt, plus checks on where the user is signing in from. The device side often gets left behind. A managed work laptop with up-to-date patches is treated the same as a random home computer of unknown health.

For a bank, that is bad. For a utility running water pumps or electricity substations, it is dangerous.

The contractor problem

Critical infrastructure runs on contractors. Maintenance firms, software vendors, engineering consultants. Each of them has legitimate reasons to log in, often with privileged accounts.

Those contractors bring their own laptops. Their patching schedules vary. Their antivirus may be years out of date. And their credentials, once stolen, look identical to a genuine employee login.

CISA has warned repeatedly that valid accounts are the most common way attackers first get into industrial systems. The 2021 intrusion at the Oldsmar water plant in Florida and the 2023 attacks on US water utilities by an Iran-linked group both started with weak or exposed credentials, not zero-days.

What device trust actually looks like

Specops and others argue for pairing every login with a real-time check on the machine itself. Is it a device the organisation knows? Is the operating system patched? Is disk encryption on? Is endpoint protection running and reporting in?

If any answer is no, the login either fails or drops into a restricted mode with no access to sensitive systems. The user experience stays simple. The security bar goes up sharply.

This matters most for remote access into operational technology, the specialised computers that control physical equipment like pumps, valves and turbines.

What critical infrastructure operators should do

Audit which accounts can reach operational systems, and from what devices. Require multi-factor authentication on every remote login, without exception for contractors. Block sign-ins from unmanaged or unhealthy devices for anything touching control systems. And check password databases against known breach lists, so reused credentials get caught before an attacker uses them.

None of this is new advice. The gap is in the doing.