This article is concerning, but not particularly surprising.  Industrial security controls have, for far too long, been focused on obscurity and not true controls and monitoring.

https://www.infosecurity-magazine.com/news/critical-infrastructure-defenses/