Smoke on the water plant: a 2/5 attacker and a city's chlorine levels
In March 2016, attackers rated 2 out of 5 in sophistication reached the chemical-dosing controls of a US water utility — through a SQL-injected payment portal, a password left in a plaintext config file, and a physical Ethernet cable that bypassed every logical safeguard standing between them. A case study in why the least-skilled attacker in the building is still dangerous once the architecture has already done the work for them.