The week of October 1st, Project SHINE found an electric substation directly connected to the Internet. Project SHINE analysts were able to see DNP3 ports, Serial Port Server ports, Telnet interface ports, and a web page server. As of the week of October 7th, the substation device was disconnected. The Project Shine investigator will present a detailed case history with time lines of this case at the October ICS Cyber Security Conference.