Counterfeit PLCs on the Plant Floor: What a $2,000 eBay Controller Almost Cost One Customer

A box of Allen-Bradley hardware sitting on a plant floor doesn’t usually stop a sales call. This one did. Chad DePasquale, VP of Sales and Marketing at HESCO, was walking a customer’s facility when he noticed a large carton with roughly fifteen smaller boxes packed inside it. He asked what was in it.

SLC controllers. Discontinued, no longer available new from the manufacturer, and the maintenance team wanted spares on the shelf before the installed base started failing. Reasonable strategy. The problem was the sourcing: they’d bought them on eBay.

What followed is a case study in how counterfeit industrial hardware reaches a plant floor, how it gets caught, and what it costs when it doesn’t.

The Tell Was the Label, Not the Part

The packaging passed a glance. It looked like a normal Rockwell box, and the controller inside looked like a normal controller — the customer’s own technician said as much while pulling it out of the static bag and turning the keyswitch.

What tipped Chad off was condition. The white label on the exterior was pristine: no wear, no yellowing, no edge scuffing. The production date printed on it read 2020. In 2026, a six-year-old label that has moved through a distribution channel, sat in a warehouse, and shipped internationally should show something. This one looked like it had been printed the week before.

That’s the field check most people skip: don’t just look at the part, look at whether the packaging’s apparent age matches the date printed on it.

Serial Number Verification Is the Step That Settles It

Chad photographed the label and ran the serial number through Rockwell’s portal back at the office. The serial came back as a valid record — which is exactly why “it’s in the system” is not, on its own, a clean result. Two things did not reconcile.

What the box claimed, against what the serial number returned in Rockwell’s portal. Details per Chad DePasquale, HESCO.

Add the origin (shipped from China) and the price, and the picture is unambiguous. Rockwell Automation’s own guidance points the same direction: most counterfeits it currently investigates originate in Asia Pacific, China in particular, and it treats all “new” Rockwell product listed on peer-to-peer marketplaces as gray market by default. Product from unauthorized sources also isn’t eligible for Rockwell warranty coverage, and software licenses resold through those channels have been deactivated.

The Cybersecurity Exposure Is the Part People Underestimate

A counterfeit controller is a reliability problem. A counterfeit programmable controller is a network problem.

Think through the sequence if that unit had gone into a rack. An untrusted device with onboard memory of unknown provenance joins a control network. If that network isn’t properly segmented and secured, whatever is resident in that memory has a foothold on the plant floor — and a path toward the enterprise side, where the ransomware conversation starts.

This customer had a mitigating factor: they’re in aerospace, and their plant floor is firewalled off from the outside world. That’s the right architecture, and it is still not a guarantee. As Chad put it, there’s always a way out, there’s still a connection, and there’s still a chance. Segmentation reduces blast radius; it doesn’t make an untrusted device safe to install.

The failure modes worth mapping before you install any unverified controller:

• Malware or a backdoor resident in onboard memory, active the moment the controller joins the network
• Lateral movement from OT to IT if segmentation is incomplete, escalating to a production-stopping ransomware event
• Unknown build quality — no assurance the unit was built to OEM specification with OEM components
• Premature failure on hardware whose legitimate service life runs 10, 15, 20, even 25 years

Run the Actual Math on the “Savings”

The apparent win here was roughly $13,000 per controller. Set the ransomware scenario aside entirely and it still doesn’t hold up. One counterfeit unit fails in service: diagnose the fault, pull the controller, install a replacement, upload the program, run a cycle to confirm — call it two hours of unplanned downtime on a production line. For most operations, those two hours alone exceed the savings. Add a ransom demand and the comparison stops being close.

Discontinued Does Not Mean Unsupported

Here’s the assumption that put this customer on eBay in the first place: once a product is discontinued, the distributor and the OEM can’t help anymore. That’s wrong, and it’s the most useful takeaway from this story.

Rockwell continues to remanufacture a large share of its legacy hardware. It isn’t a blanket statement — component availability rules some items out — but on the whole, the old product is still supported. Two paths make that available:

• Inventory Plus. HESCO can place remanufactured units on site at your facility, so the spare is on your shelf before you need it. That’s what “bridging the gap to modernization” looks like in practice: you keep the legacy line running on legitimate, factory-spec parts while you phase a modernization on your own schedule. This same customer, at a different location, was set up with an Inventory Plus covering PLC-5 parts — a platform discontinued 15 to 20 years ago.
• Priority exchange / remanufacturing hub. No contract required. If a unit fails and you don’t have a spare, call your distributor. In most cases the remanufactured replacement is already sitting in Rockwell’s priority exchange hub and ships overnight. You install it, put your failed unit in the box the replacement arrived in, and send it back. Transaction closed, line running.

Between those two options, there is very little reason to accept counterfeit risk on obsolete hardware.

The Bottom Line

This customer got lucky. The counterfeit controllers were caught on a shelf instead of in a rack, by someone who knew to check the label’s condition and verify the serial number against the manufacturer’s records. Buy from authorized distribution, treat peer-to-peer marketplaces as gray market, verify serial numbers on anything that arrives with a story attached, and call your distributor before you conclude a discontinued part can’t be sourced legitimately.