How Juneau's Water Utility Closed Its OT Blind Spots
Summary: The City and Borough of Juneau, Alaska, which operates water and wastewater infrastructure for a population comparable to a utility serving up to 400,000 people with a team of three managing water production, came within hours of shutting off water to roughly half the city after a supply-chain incident involving a widely used remote access tool. Around the same time, Juneau discovered a distribution operator had been using default passwords across every field in its xOT logon system, and its OT environment held approximately 50 remote nodes communicating over undocumented paths, with institutional knowledge living in the heads of two or three veteran operators.
Bottom line: A three-person team carrying the same threat surface as a major regional utility was hours from cutting water to half a city, and the fix that followed - MFA first, then visibility - came from a near-miss rather than a breach. The default passwords across every xOT logon field are the part to sit with: the gap was not exotic, and it was found by accident.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026