> Critical US infrastructure is not connected to external public networks Oh you sweet summer child, you don't need to attack that directly. Billing systems are certainly internet connected, and that is what got breached in this case. You think a for profit company is going to send out gas and NOT bill for it? You don't need internet connectivity when you have a working internal login, and can get into a related office somewhere, or can get your way into that network via a social engineering attack. All it takes is time.