Having done assessments of IT/OT Infrastructure this is not surprising. Lots of critical infrastructure sectors have massive asset inventory issues (among other massive issues, often forming a nasty feedback loop) where they just don’t know what they have, what’s running on it, etc. I have literally found servers in closets that were powered on and connected to a network that nobody knew existed. And several different incorrect versions of network architecture and configuration is common. It’s no surprise that they have an incomplete asset inventory and had no record of that asset.

The cost to fix all this properly is going to be astronomical. There will be soooooo much work that will need to be done.