In December 2024, ransomware encrypted approximately 1,000 IT systems across ten of the eleven Romanian water basin administrations under Administrația Națională "Apele Române". Servers running GIS, email, and web services went down. Domain controllers were compromised. The threat actor used BitLocker — a legitimate Windows tool — to lock files and demand contact within seven days.
Water operations continued. The operational technology systems controlling dams and hydrotechnical infrastructure were not affected. That outcome was fortunate, not the result of deliberate isolation design: DNSC's post-incident analysis found that the authority had been operating outside the national cyber defence system entirely. The integration gap that allowed that situation to persist for years is precisely what NIS 2 is designed to close.
4,148 controllers answering on port 44818
On July 30, 2026, Censys published a snapshot of internet-exposed industrial control equipment. Their scan identified 4,148 Rockwell/Allen-Bradley EtherNet/IP controllers responding on port 44818 — the standard port for the EtherNet/IP protocol used by most modern Rockwell programmable logic controllers (PLCs). Of those hosts, 59% were on mobile carrier networks: Verizon Business, AT&T Mobility, and T-Mobile USA. Cellular modems at pump stations, substations, and municipal water facilities are the most common reason a PLC ends up with a public IP address.
A concurrent analysis by Forescout Vedere Labs found 4,407 internet-facing Rockwell controllers globally, and identified 22 of them as geolocated in cities where water or wastewater utilities had reported cyberattacks in the weeks immediately preceding the analysis. Nineteen of those 22 controllers were running firmware with a known vulnerability — CVE-2017-16740, a Rockwell-rated CVSS 8.6 flaw — sitting unpatched nine years after publication.
The most common device: MicroLogix 1400 units, which account for roughly half of all exposed systems.
What an exposed EtherNet/IP port enables without any exploit
Port 44818 is not simply a management interface in the way a web console is. EtherNet/IP operates over CIP (Common Industrial Protocol), and without authentication or encryption — which most field deployments do not enable — an attacker who can reach port 44818 can do the following before invoking a single CVE:
Read the device identity response. Every EtherNet/IP device responds to identity queries with the product name, model number, and firmware version in plain text, unauthenticated. This is not a vulnerability; it is the protocol working as designed. For an attacker, it is a complete inventory of what you are running and what vulnerabilities apply to it.
Write to the controller. Depending on device configuration, CIP operations on port 44818 can allow an attacker to change IP settings, set passwords, or alter control logic — without exploiting any disclosed vulnerability. In July 2026, attackers gained access to the control systems of more than 30 municipal water systems in Minnesota by connecting to exposed EtherNet/IP ports and issuing CIP commands. They changed IP configurations and locked operators out. No CVE was in the exploit chain.
Access adjacent services. In the Censys global dataset, the same hosts running exposed EtherNet/IP also ran 771 exposed VNC instances, 292 Modbus services, and 280 Telnet servers. One cellular modem at a remote pump station can expose an entire layer of OT infrastructure simultaneously.
The Censys and Forescout research was published in response to a coordinated advisory from the FBI, CISA, NSA, EPA, Department of Energy, and US Cyber Command in early April 2026, which identified Iranian-affiliated threat actors systematically targeting internet-facing Rockwell PLCs at water utilities.
NIS 2 and Romanian water utilities: what essential entity status actually means
Under NIS 2, water supply and wastewater treatment operators that meet the size threshold — at least 50 employees, or annual turnover above EUR 10 million — are classified as essential entities. This is the more stringent of the two NIS 2 categories.
Essential entity classification in Romania, transposed through OUG nr. 155/2024 and consolidated through Legea nr. 124/2025, carries obligations that differ from important entities in two significant ways. First, supervision is proactive: DNSC can require audits, inspections, and evidence of implemented controls without waiting for an incident to occur. Second, the penalties are higher: up to EUR 10 million or 2% of global annual turnover, whichever is greater, plus personal liability for management under Article 20 for failures to approve and oversee risk management measures.
On the substance, NIS 2 requires essential entities to implement measures covering:
- Asset inventory: every system in scope — which, for water utilities, explicitly includes operational technology and industrial control systems, not just IT infrastructure.
- Access controls: authentication for remote access to OT systems; management of vendor and maintenance contractor access.
- Network segmentation: IT and OT networks must be separated. A cellular modem that places a PLC on the public internet is not a compliant architecture under NIS 2.
- Incident reporting: early warning to DNSC within 24 hours, full notification within 72 hours, and a final report within one month for significant incidents.
- Supply chain security: obligations extend to vendors and integrators with access to OT environments, including remote maintenance providers.
DNSC found after the December 2024 Apele Române incident that the organisation had not been integrated into the national cyber monitoring infrastructure. NIS 2 makes that integration mandatory, not optional.
What an industrial security test covers for a water utility
The phrase "penetration test" in an OT context does not mean the same thing as in a web application context. Industrial security testing at a water utility typically starts with the questions that precede any technical check:
- Does an asset inventory exist that includes every PLC, HMI, engineering workstation, historian server, and network device in the OT environment?
- Are OT systems reachable from the IT network, or from the internet?
- How do maintenance vendors connect — direct internet access to OT, site-to-site VPN, or physically on-site only?
- When were firmware versions on controllers last reviewed against published advisories?
From there, network-level discovery maps which services are reachable from which zones. EtherNet/IP identity queries, Modbus polling, and passive traffic analysis surface devices that do not appear in any CMDB. Vendor remote access paths are traced and tested for authentication gaps. Engineering workstations — often Windows machines with direct PLC access, running software updated on a years-long cycle — are reviewed for patch status and local privilege escalation paths.
The purpose is not to disrupt production. It is to produce an inventory that matches reality and identify the paths by which an attacker with network access could reach a controller.
Our OT/ICS penetration testing covers exactly this scope — from external attack surface mapping through segmentation testing to controller-level access verification, structured around the inventory and access-control requirements of NIS 2.
Where to start if you have not started
The Romanian context adds one specific pressure that is easy to overlook. The December 2024 incident did not target OT. It targeted IT systems that happened to sit in the same organisation as OT. The absence of IT/OT segmentation and the absence of the organisation from national monitoring infrastructure meant that IT compromise was an inch away from becoming OT compromise.
NIS 2 does not require a water utility to have perfect security. It requires a documented risk management programme, a verifiable asset inventory, defined access controls, and the ability to detect and report an incident when it happens. For many Romanian water utilities, the first step is establishing which systems exist and which of them are reachable from the internet.
See the NIS 2 / DORA compliance checklist for the full list of measures that apply to essential entities and the documentation you will need to demonstrate compliance.
General information, not legal advice. Specific compliance obligations depend on your organisation's classification and the current state of Romanian secondary legislation under NIS 2.
Sources: The Hacker News and Forescout Vedere Labs — Rockwell/Allen-Bradley EtherNet/IP exposure analysis (August 2026); Censys — Iranian-affiliated APT targeting of Rockwell PLCs (July 30, 2026); BleepingComputer and Security Affairs — Apele Române ransomware incident (December 2024); FBI/CISA/NSA/EPA/DOE/US Cyber Command joint advisory on water sector PLC targeting (April 2026); DNSC post-incident statement (December 2024).