Internet-accessble industrial control systems have been a problem for many years now. It's a documented issue but it's difficult to fix for a variety of reasons:
1. Difficult to identify the owner: a lot of the devices are on mobile networks that don't point to an obvious owner.
2. Unknown criticality: is it a demo system or something used in production?
3. Security budget: lots of smaller utilities don't have a budget for buying cyber security products.
That being said, based on the numbers in Shodan the situation has improved over the past decade. And there's been a large resurgence of startups in the ICS space (ex https://www.dragos.com, https://www.gravwell.io). Here's a current view of exposed industrial devices on the Internet:
1. Difficult to identify the owner: a lot of the devices are on mobile networks that don't point to an obvious owner.
2. Unknown criticality: is it a demo system or something used in production?
3. Security budget: lots of smaller utilities don't have a budget for buying cyber security products.
4. Uneducated vendor: sometimes the vendors of the device give very bad advice (https://blog.shodan.io/why-control-systems-are-on-the-intern...)
That being said, based on the numbers in Shodan the situation has improved over the past decade. And there's been a large resurgence of startups in the ICS space (ex https://www.dragos.com, https://www.gravwell.io). Here's a current view of exposed industrial devices on the Internet:
https://beta.shodan.io/search/report?query=tag%3Aics&title=I...
I've written/ presented on the issue a few times:
https://blog.shodan.io/taking-things-offline-is-hard/
https://blog.shodan.io/trends-in-internet-exposure/
https://exposure.shodan.io/#/