Local Governments Face OT Attacks via Shodan-Exposed PLCs and Modbus on Port 502
Updated
Updated · IBM · Sep 2
Local Governments Face OT Attacks via Shodan-Exposed PLCs and Modbus on Port 502
3 articles · Updated · IBM · Sep 2
Summary
Internet-exposed OT in local governments is giving attackers a direct reconnaissance path to PLCs, remote-access systems and Modbus services that can be found through Shodan.
Shodan does not create the weakness; it indexes systems already reachable online, letting attackers search by protocol, device type or geography and identify a municipality only afterward.
Port 502 is a key concern because Modbus/TCP often lacks encryption, authentication and integrity checks, meaning exposed devices may reveal process data or even accept commands affecting pumps, valves, pressure and tank levels.
Federal warnings show the risk is already operational: agencies said Iranian-linked actors targeted internet-connected PLCs in 2026, and the FBI and EPA reported attacks in at least seven states that changed PLC settings and caused water-pressure loss and flooding.
For municipalities running long-lived infrastructure with small staffs and many contractors, the report says recurring external exposure checks, segmentation, controlled remote access and tighter governance are now essential because obscurity no longer protects OT.