It's not even cloud-based vulnerabilities. It's likely control over the SCADA systems which are highly vulnerable to simple, outside attacks. SCADA are "smart" devices which control things like water valves in a treatment plant; relay/transfer systems in power substations; railroad track switches; and valve actuators in pipelines to name a few. A few years back, there was a website which scoured the internet for unsecured SCADA devices.