This is something I have long thought about. The more critical components are encrypted, and secured better, but still it makes you wonder if its enough. There was a paper written on the issue once where they successfully demonstrated the ability to take over a small hydro power dam just through a basic internet connection in a few minutes.
I have long advocated that utilities build their own private fiber optic SCADA network separate from any internet that only employees have access to within on going encryption changes... but the cost and complexity isn't something anyone wants to invest in.
The irony comes from what SCADA is in itself trying to fix (or rather cover). Distribution and transmission automation is taking off to add plasticity (to compensate for physical weakening) and operational cost reduction to a severely dated system. Its meant to cover over what physical hardening and labor should be doing at a lower price. The end result is just opening a security issue.
FWIW I have long heard rumors the Chinese have already extensively gathered secure data on nearly all our SCADA networks. Its probably so they can see how one of our sewage treatment plants work so they can build the came (free intellectual property), but all that shows is how easy it is to gain access.