Cybersecurity - utilities impacted - what do you think?

There's a lot going around about utilities getting "hacked" but preliminary information is that the utilities impacted have PLCs directly connected to the internet, no firewall, with no password set.

What do you think of that?

Do not provide any examples from your own environment. If you've got intenet-exposed stuff, make sure it's locked down.