Hackers are already reaching into the controllers that run industry. Chemical plants must learn to spot an intruder who behaves exactly like an engineer, warns top OT security expert Alon Nachmany.
In August 2026, five US agencies, including the Federal Bureau of Investigation (FBI), the National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA), warned that unknown hackers were probing Siemens programmable logic controllers across American critical infrastructure, naming the chemical sector among the targets.1
These controllers are the small industrial computers that open valves, start pumps and hold a reactor at the right temperature. The attackers used AI-written scripts disguised as legitimate monitoring tools. To anyone watching the network, they would have looked like the plant’s own housekeeping.
A month earlier, US agencies described a case from a campaign they attribute to Iranian-affiliated actors: attackers loaded a modified program onto a controller that kept its normal functions running while overriding specific instructions.2
Separately, water utilities in at least seven states reported attacks to the FBI, some causing loss of pressure and flooding.3
Those were crude: controllers left on the open internet, passwords and settings changed, operators locked out of their own equipment. Crude still worked, though, and officials haven’t said who was behind those.4
When a chemical plant gets breached, what you’re worried about is a release, a fire, a runaway reaction, or a safety system told to stand down. And the attack that gets you there usually doesn’t trip an alarm. It looks like an engineer logging in on a Thursday to do routine work.
I’ve been a chief information security officer four times, and I’ve spent my whole career on the defending side.
That includes one of the largest water utilities in the US and a top-five global airport, places where a bad day on the network can turn into a bad day for a lot of people.
For years I was the customer. I bought the security tools, and most of them were good at one thing: telling me what was on my network. What they mostly couldn’t tell me was when something that looked normal wasn’t.
Part of the problem is the equipment. Most chemical plants run on control systems designed decades ago, when the biggest threat to a control room was a spilled cup of coffee.
Many will obey any correctly formatted command, from anyone. You can’t just patch them on a Tuesday afternoon, because restarting a controller can mean halting a process that took days to bring online. Even the aggressive scanning that office IT teams run every week can knock some of them over.
So, you can’t run plant security the way you run office IT. In the office, data comes first; on the plant floor, it’s people and production. Teams that confuse the two end up with programmes that look great in a board deck and fall apart in the control room.
The pushback I get most from plant managers is “we’re air-gapped.”
Often that was true the day the plant was commissioned. Then a vendor needed remote access for support, a contractor added a modem, and head office wanted a live reporting link.
The FBI noted that several victims shared network setups installed by the same third parties, which let attackers repeat one success across many sites.3
Anyone holding the keys to your controllers is part of your supply chain, whether procurement knows about them or not. I’d start with four things, and none of them need a seven-figure budget.
- Start by looking before you touch anything. That means taking a copy of the control network’s traffic off a switch port and reading it. The sensor never talks to a controller, so there’s nothing to knock over. Give it a week or two and you’ll usually find devices nobody had on the list, and a couple of connections nobody can explain.
- Next, learn what normal looks like at your site, not at some generic plant. Every facility has its own rhythm: who logs in, when, and which settings change. An operator login at 3am that alters a temperature setting untouched for two years is perfectly valid on paper. Against your own plant’s rhythm, it sticks out a mile. Keep a known-good copy of every controller program too, and compare the running version against it, so you know the moment one changes. That’s precisely what the agencies asked operators to do in July.*2
- Then tie security to safety. A cyber alert on a safety system deserves the same response as a safety fault. The International Electrotechnical Commission (IEC) standard 62443 gives engineers a way to divide a plant into zones with tightly controlled connections between them. It earns its keep when you’re laying out the network, not the week before an audit.
- Last, control who can reach your controllers, especially vendors and integrators. Keep the list short and know when each login gets used.
Retail learned this the hard way. In 2013, attackers stole payment card data belonging to about 40 million Target customers. They got in using login credentials stolen from the retailer’s heating and air-conditioning contractor.5 Nobody had locked that access down. Target sells groceries, not ethylene, but I’d bet every plant reading this has a contractor like that.
Here’s what bothers me most. The largest producers have their own industrial security teams and can pay for the leading platforms, which are built and priced for companies like them.
The regional producer, the specialty manufacturer, the site where one IT manager looks after three plants, gets the same attackers and a fraction of the budget. I’ve compared notes with more than thirty security chiefs and plant leaders across utilities, airports and manufacturing. Very few told me they didn’t understand the risk. What they told me was that they didn’t have the money or the people.
In Europe, the Network and Information Security Directive (NIS2) brings medium and large chemical manufacturers into scope, makes senior management accountable for cyber risk and requires an early warning of significant incidents within 24 hours.6
So the tools have to get cheap and simple enough for the plants those rules cover.
In 2017, malware known as Triton targeted the safety systems of a petrochemical plant in the Middle East. It was discovered only because a coding mistake tripped the plant offline.7
The most capable attackers of 2026 are more careful. The next one may not slip up, and the plants that can pick out a fake engineer are the ones I’d expect to still be running.
Alon Nachmany is a four-time chief information security officer who has deployed operational technology security in critical infrastructure, including at one of the largest treated-water utilities in the US and a top 5 global airport. He has also secured Fortune 100 networks. He has been featured by Inc., ABC News and the US Department of Energy (DOE), and was named to the Top Global Cyber 40 Under 40 in 2023. He is a member of InfraGard, the FBI’s partnership with the private sector, and the Foundation for Infrastructure Resilience (FIR), and founder and chief executive of Tabor Security, an operational technology security company.
REFERENCES
- CyberScoop, “AI-fueled attacks pose ‘active threat’ to water, other sectors, U.S. agencies warn,” 20 August 2026. https://cyberscoop.com/hackers-use-ai-target-siemens-plcs-critical-infrastructure/
- CISA, FBI, NSA, EPA et al., Joint Cybersecurity Advisory AA26-097A, “Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure,” updated 22 July 2026. https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a
- FBI, “Malicious Cyber Actors Targeting Water and Wastewater Sector Internet-Facing Programmable Logic Controllers, Causing Operational Disruptions,” 2026. https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet–facing-programmable-logic-controllers-causing-operational-disruptions
- CBS News, “U.S. investigating if Iran was behind cyberattack on water systems in 7 states, including Minnesota and Michigan,” August 2026. https://www.cbsnews.com/news/us-investigating-iran-cyberattack-minnesota-water-systems/
- Krebs on Security, “Target Hackers Broke in Via HVAC Company,” 5 February 2014. https://krebsonsecurity.com/2014/02/target-hackers-broke-in-via-hvac-company/
- Directive (EU) 2022/2555 (NIS2), Official Journal of the European Union. https://eur-lex.europa.eu/eli/dir/2022/2555/oj
- MITRE, “Cyber Risk to Mission Case Study: Triton,” 2022. https://apps.dtic.mil/sti/trecms/pdf/AD1183008.pdf
