The article said the virus was on "a computer system retrofitted in 2008 with data visualization software associated with equipment for moving nuclear fuel rods

The article said the virus was on "a computer system retrofitted in 2008 with data visualization software associated with equipment for moving nuclear fuel rods". Control systems generally have two components; the actual controllers that interface with the machine or equipment and then an HMI for the operator to interface with the controller (ignoring completely hard wired systems consisting of lights, buttons, chart recorders, etc). The majority of the HMI software runs on windows. Once an attacker is on the HMI system they can probably easily do anything the operator can do, and possibly have full access to the controller and make things happen that Should Never Happen.