In late July, water utilities in at least seven U.S. states started reporting the same problem to the FBI. Someone gained access to their industrial controllers over the internet, changed the IP addresses and passwords, then locked the operators out. Sites lost water pressure and reported flooding. This followed an incident in 2025 when attackers opened a floodgate at a dam in Norway and released water for four hours. One year earlier, hackers used an exposed control interface at a Texas water facility to activate pumps and overflow a municipal tank.
Just days before this summer’s attack on the U.S. water facilities became public, Coca-Cola disclosed a ransomware attack on its dairy subsidiary, Fairlife. Unauthorized access halted production at every plant nationwide. Stock fell 4%, and eleven days into the breach, the company could still only report “significant progress” toward restoring operations.
And seven months before that, attackers targeted Poland's power grid through vulnerable internet-facing edge devices. The wiper malware destroyed data on operator screens and damaged the remote terminal units that translate commands into physical actions. Grid operators lost the ability to see or control across more than 30 sites for hours. While power stayed on that day, it didn't have to.
The attacks keep coming, regardless of the industry you’re in. And in most examples, once the attacker got past the first door, nothing else stood in the way.
The FBI and EPA's advisory on the water utility attacks explicitly said what to do about it: get these PLCs off the public internet, put a gateway in front of them, and limit which controllers are allowed to talk to which. The advice is neither complicated nor new. Utilities and manufacturers have been hearing some version of it for a decade.
The hard part is what happens after you follow that advice. If you pull a device off the internet entirely, you lose the ability to manage or monitor it without sending someone to the site. If you build a custom VPN and firewall setup instead, now that setup is its own maintenance job, repeated at every location. Most industrial teams end up with a patchwork of firewall rules here, a jump box there, consistent at none of their sites, and audited at even fewer.
Closing the Gap: Portainer and Xiid
Portainer and Xiid built a joint architecture around this specific problem. Xiid's Terniion software opens an outbound-only encrypted tunnel from each device the moment it starts up, and every inbound port stays closed. Scan the network from outside and there's nothing to find: no open port, no public IP address, nothing to connect to. The device can still reach out with a connection locked to the process level, so if one device is compromised, whoever did it can't use that foothold to move sideways into the rest of the network.
That tunnel runs through Xiid’s self-hosted connector layer, where Portainer plugs in. It deploys the containerized software running on the device, pushes updates, and gives an operator visibility into the entire fleet from a single console, without anyone driving to a site to make a routine change.
None of this asks a team to rebuild what's already installed. It runs on top of the gateways and devices already in the field, and it answers the specific question the FBI and EPA are now asking utilities directly: can you show that the connection you use to manage a device isn't also the way someone else gets in? That pattern suggests it’s worth being able to answer before the next one.
See the full architecture in our whitepaper, Visibility and Control at the Industrial Edge.