This is negligence on behalf of the water authority. 10+ years ago I used to do demonstrations of this specific attack for govt and other critical infrastructu

This is negligence on behalf of the water authority. 10+ years ago I used to do demonstrations of this specific attack for govt and other critical infrastructure owners. In our demo, we had a two small vats of coloured "chemicals," with pumps controlled by a bank of PLCs, an HMI and a network of a bunch of vulnerable VMs. We would walk people through how to exploit trivial web vulnerabilities that would get them to the HMI and cause the pumps to reverse and cause a chemical spill from the vats. The look on their faces when they caused a vat to overflow themselves with very little skill, was their "scared-straight" moment. It was 90's, even 80's level hacking. There is no way the managers didn't know this was possible and likely. They're only acting surprised. What this really looks like to me is a test run for something more coordinated and worse.