Attackers didn't hack those water systems. They just found them.

On July 30, the FBI and the Environmental Protection Agency warned that attackers had taken control of systems at municipal water utilities in at least seven states. In Minnesota alone, more than 30 facilities were affected. Some plants lost the ability to monitor and control their own equipment and had to run manually.

Here's the part that should travel beyond the water sector. There was no zero-day and no custom malware. The equipment was reachable from the internet, and whatever password stood in front of it wasn't good enough. Federal advice to operators boiled down to: get it off the open internet and put a real gateway in front of it.

That's not an infrastructure story. It's an exposure story — and exposure is something every business has, including yours.

You have an external attack surface. You probably can't list it.

Your external attack surface is everything that answers when a stranger knocks: every domain and subdomain, every public IP, every open port, every service listening behind them.

Almost nobody can list theirs accurately, and it isn't carelessness. It's accumulation:

• A contractor stood up a staging server in 2022 for a project that shipped. Nobody turned it off.
• Someone opened remote desktop "just for the weekend" during an office move.
• Marketing launched a campaign on a subdomain, then the campaign ended.
• A developer spun up a database in the cloud to test something, with the default settings.
• A cloud resource got deleted — but the DNS record pointing at it didn't.

Each one was a reasonable decision by someone competent. None of them were revisited. And your firewall can't help with any of it, because these things aren't behind the firewall.

Attackers don't find you by picking you

The mental model that gets businesses hurt is imagining a person deciding to target them. That's not how this works at any volume.

Automated tools scan the entire internet continuously, cataloguing what's listening on every address. Nobody chose those water plants off a list — a scanner found something reachable and a human followed up. The same scanners have already catalogued whatever you have facing the internet, whether you know about it or not.

There's a second discovery channel most owners have never heard of. Every time you get an HTTPS certificate for a hostname, that hostname is published to public Certificate Transparency logs — permanently, by design, so browsers can catch forged certificates. It's a genuinely good system. It also means old-portal.yourcompany.com and test.yourcompany.com are a public matter of record from the moment their certificates were issued. Attackers read those logs. Forgetting about a subdomain doesn't make it private.

What's actually sitting out there

When we look at small and mid-sized businesses from the outside, the same things come up over and over.

Remote-management ports. Remote Desktop (port 3389) facing the open internet is, year after year, the single most common way ransomware gets its first foothold. Attackers scan for it around the clock, then run a dictionary of passwords against whatever answers. VNC often has no authentication at all. Add SMB, Telnet, FTP, and hosting control panels like cPanel or Webmin, and you have a set of doors that should never be visible from the internet — access belongs behind a VPN, a bastion, or an identity-aware proxy.

Databases with no password. This one still surprises people: MongoDB and Redis historically ship with no authentication by default. Bind one to a public address without thinking about it and anyone who connects is already inside. MySQL, PostgreSQL, and SQL Server are only marginally better in practice. A database should never be reachable from the internet, full stop.

Dangling DNS records. A subdomain whose DNS still points at a deleted cloud resource is a live risk, not stale clutter. Anyone can often claim that resource name and start serving content on your domain — a convincing phishing page on a hostname your customers recognize.

Hosts already flagged as compromised. Public indexes tag machines they've observed serving malware or acting as part of a botnet. Sometimes the first honest answer to "were we breached?" is sitting in a public dataset nobody on your side has looked at.

Software with known holes. Public indexes record the versions running on internet-facing hosts and which published vulnerabilities they match. An attacker doesn't need to probe you to know your web server is three years out of date — the answer is already indexed.

The useful asymmetry

Here's what makes this a solvable problem rather than a scary one: the sources attackers use are public. Certificate Transparency logs, internet-wide scan indexes, DNS records, published registration data — none of it requires special access. It's the same information, sitting in the open, available to either side.

The only real difference is that attackers look and most businesses don't.

So the questions worth answering this week:

1. What of ours answers from the internet right now? Not what should — what does. Start with an actual inventory rather than memory.
2. Is any of it something we'd never have chosen to expose? Remote-management ports and databases are the two that turn into incidents.
3. Are there names in the DNS pointing at things that no longer exist?
4. When does anyone check again? This drifts. A clean answer in March isn't an answer in August — someone always spins something up.

The honest takeaway

Those water utilities weren't beaten by sophistication. They were beaten by an inventory problem: something was reachable that nobody meant to leave reachable, and no one on the inside knew it before someone on the outside did.

That's exactly what Tenant Strike's external surface scan is for. It looks at your organization the way those internet-wide scanners do — pulling from the same public sources — and gives you the list: which of your domains and addresses answer, which ports are open, which services are exposed that shouldn't be, and which hosts are running software with known holes. Alongside it we read your Microsoft 365 and Azure configuration in read-only mode, because the accounts without MFA and the legacy sign-in paths that bypass it are the other half of the same question.

You don't need to sign up to start. Put your domain into our free scan and you'll see what's facing the internet in about ten seconds — no account, no credentials, nothing to install.

Attackers have always had this view of your business. Now you do too.