As a former PW director and having gone through several system audits required by to law, since 9/11, to verify the protection of the system from physical and electronic attacks, I am shaking my head that this could happen to a modern-day facility.
As a Retired Water Treatment Plant Operator I can tell You that they are using Internet to connect from Site to Site. That’s how the scumbags are breaching the System. The simple solution is to use Radio Links from the WTP SCADA to the Remote Site(s) and do not connect the WTP SCADA to the Internet AT ALL. The SCADA must be a dedicated Computer that’s ONLY connected to the WTP via hardwired or Radio and to the Distribution System via Radio Links. The speed difference is negligible between a Radio Link and an Internet Link.