UK NCSC warns internet-exposed OT systems are being targeted, causing real-world disruption

The UK NCSC says it has seen increased targeting of operational technology systems across multiple sectors globally, including in the UK, by a range of threat actors, resulting in some limited real-world disruption ^[1]. Any organisation with internet-exposed OT could be affected, and the NCSC warns not to assume OT is unreachable from the internet without verifying, as misconfigurations, legacy connections or unmanaged assets can expose it ^[1]. The NCSC advises building a definitive view of OT assets, ensuring OT devices are not directly accessible from the public internet, and replacing default credentials while strengthening access controls ^[1].

Industries mainly affected: Cross-industry

1. Build a definitive OT asset view and keep PLCs and HMIs off the public internet ^[1].
2. Replace default credentials, stop shared passwords and enable MFA ^[1].
3. Strictly control external access to OT and keep boundary devices supported and updated .