Since late July 2026, a coordinated wave of cyberattacks has targeted municipal water and wastewater systems across at least twelve states: Michigan, Minnesota, Georgia, South Dakota, and more. In this episode, the hosts dig into how attackers are actually getting in: not through some elaborate zero-day, but by finding programmable logic controllers (PLCs) and other operational technology (OT) sitting exposed directly on the internet, often still running the default password from the day they were installed. They trace the root cause back to a familiar culprit, convenience.

Rural water systems are maintained by third-party contractors managing thousands of devices across dozens of municipalities, and changing a unique password per site just doesn't scale the way leaving the factory default does. The conversation connects this directly to a real, publicly known vulnerability (CVE-2023-6448 (CVSS 9.8)) first weaponized against exposed VNC connections on MicroLogix controllers, and shows how the exact same exposure pattern shows up everywhere from Flock license-plate cameras to hospital medical equipment.

Greg and Caz also work through the harder question: what's the actual motive here? With attacks spread thin across dozens of small municipalities and no ransom demand in sight, money doesn't add up as an explanation, which points toward something more unsettling: a probing operation designed to map vulnerability and sow fear, possibly state-linked.

No water contamination has been confirmed as of this recording, but at least one system has already been forced into full manual operation, and boil-water notices have gone out. The fix: get OT off the public internet. It's simple to state and brutally expensive and slow to actually implement across decades-old infrastructure that was never designed with security in mind.

0:00 Intro: A Coordinated Wave of Attacks on U.S. Water Systems

1:29 Why Default Passwords Are Everywhere in OT

4:14 Small Towns, Big Exposure (and NYC's Not-Quite-Vegan Water)

6:43 Is This a Probing Attack?

13:05 The Physical Devices Nobody Can Patch

20:36 The 2023 CVE That Predicted All of This

23:01 Beyond Water: Flock Cameras and Hospital Equipment

27:42 The Power Grid Could Be Next

34:10 Money Doesn't Explain This: Theories on Motive

36:25 What Should Utilities Actually Do?

47:06 Closing Thoughts: Simple Problem, Hard Fix

Key Takeaways:

• Since late July 2026, water/wastewater utilities in 12+ US states have been hit by a coordinated wave of attacks targeting internet-exposed PLCs and OT.
• The core vulnerability is boring, not exotic: default passwords left in place by third-party installers and maintainers who need scalable remote access.
• This maps directly onto a real, already-known vulnerability class — CVE-2023-6448 (CVSS 9.8), first weaponized in 2023 against exposed VNC connections on MicroLogix controllers.
• The same exposure pattern (no credentials, or defaults, directly on the internet) shows up well beyond water — in license-plate-reader cameras and even hospital medical equipment.
• No confirmed water contamination yet, but at least one utility has moved to fully manual operation, and boil-water notices have been issued.
• The hosts argue the motive doesn't look financial — it looks more like a probing operation testing which communities are vulnerable, possibly state-linked.
• The fix is conceptually simple (get OT off the public internet, segment networks, rotate credentials) but expensive and slow given decades-old infrastructure never designed for this threat model.

Subscribe for more episodes breaking down the cybersecurity stories that actually matter Follow us on social media for updates between episodes Visit our website for more deep dives and show notes

Greg and Caz talk with cybersecurity expert Gene Bandy about how North Korean IT workers use stolen identities and rehearsed interviews to land remote tech jobs at Western companies, funneling hundreds of millions of dollars a year back to the regime. They walk through real cases, including a laptop farm bust involving 90 laptops in one house, and share the behavioral and technical warning signs that HR and security teams can watch for, from disabled Wi-Fi to suspicious payment preferences. The conversation also covers why in-person interviews are one of the best defenses against deepfake hiring fraud, and why other countries are starting to copy North Korea's approach.

Key Takeaways:

• North Korean operatives earn the regime hundreds of millions a year through remote IT jobs.
• Stolen identities and rehearsed interviews let them pass background checks.
• Laptop farms hide where they're really working from.
• In-person interviews are a simple, effective defense.
• Other nations are starting to copy this approach.

Adam Forrester, from Checkpoint, joins the show to break down a supply-chain vulnerability in the AI coding assistant Claude Code, where an unvalidated settings file let attackers hide commands inside an otherwise ordinary-looking Git repository, no phishing required.

We dig into how the exploit works, why it had to be patched twice, how it connects to the wider problem of prompt injection, and why NIST has shown AI guardrails can never fully close the gap.

We also talk through BYOD, shadow AI use in the workplace, and what small and medium businesses without enterprise security budgets can actually do to reduce their exposure.

Key Takeaways:

• An unvalidated settings file in Claude Code allowed hidden commands to execute the moment a project was run, a new twist on supply-chain attacks.
• Guardrails alone can't solve this: NIST research shows full AI safety coverage is mathematically out of reach.
• Smaller businesses face the same risk as enterprises but with far less budget for AI-specific security tooling.

In Season 1, Episode 3 of Unsafe: A Cybersecurity Podcast, Greg and Caz compare the unconventional paths that brought them into the field and ask what actually makes a candidate stand out. From career changers and home labs to practical experience, professional communities, and the pressure to keep learning, they explore why curiosity and enthusiasm can matter as much as what appears on a résumé.

The work can be fascinating, demanding, occasionally brutal, and definitely not for the faint of heart. So how do you know whether cybersecurity is the right career—or simply the career everyone thinks they want?

Subscribe to Unsafe for candid conversations about cybersecurity and the realities behind the job description.

In Season 1, Episode 2 of Unsafe: A Cybersecurity Podcast, Greg and Caz unpack a real 2026 identity-theft case that crossed financial institutions, state lines, corporate records, and law-enforcement jurisdictions. They examine the personal toll, the blind spots between banks and monitoring services, and the unsettling ease with which low-tech social engineering can defeat supposedly sophisticated safeguards.

Your information may already be out there. The real question is: who is ready to use it?

Subscribe to Unsafe for more candid conversations about cybersecurity risks hiding in plain sight.

In this episode of Unsafe: A Cybersecurity Podcast, co-hosts Greg and Caz examine the uncomfortable reality of third-party risk. Beginning with the 2026 Canvas cybersecurity incident, they explore the hidden dependencies behind SaaS platforms, cloud services, integrations, outsourced support teams, and the vendors behind your vendors.

How many organizations actually know everyone who can access their critical information—and how many are simply trusting the black box?

Subscribe to Unsafe for candid conversations about cybersecurity risks businesses cannot afford to ignore.