CISA Alert: PLC Targeting Campaign Hits Water Utilities Across Seven US States

CISA issued an advisory on July 30, 2026 confirming a coordinated campaign targeting internet-exposed programmable logic controllers (PLCs) at water and wastewater utilities. The campaign has been reported by utilities in at least seven states, with initial activity identified on July 26–27, 2026, when Minnesota reported hackers had targeted approximately 30 water systems in the state. The FBI has received incident reports from utilities in all seven affected states.

The operational impact has been concrete. Threat actors modified device passwords to lock out operators, then changed IP addresses to physically disconnect the PLCs from network management. The result: boil-water notices issued to communities dependent on affected utilities, and utilities reverting to manual operations while systems were assessed and recovered.

Attack Method: No Novel Exploit Required

The campaign did not require a zero-day vulnerability or sophisticated tooling. CISA’s advisory is explicit on this point: the attack vector is direct access to internet-exposed PLC interfaces. Devices from Rockwell Automation/Allen-Bradley, Siemens, and Schneider Electric were specifically named as affected equipment. Cellular modems used for remote access — common in smaller water utilities where direct network connectivity is impractical — were flagged as a blind spot in routine attack-surface scanning.

The exploitation pattern follows a straightforward sequence:

Identify internet-exposed PLC or HMI interfaces using public scanning infrastructure (Shodan, Censys, or similar)
Authenticate using default credentials, guessed credentials, or exposed authentication interfaces
Modify operator password to deny legitimate access
Change device IP address to disconnect device from management network

No malware deployment, no persistence mechanism, no lateral movement — just authenticated reconfiguration of an exposed device. The attack is low-skill, repeatable at scale, and achieves immediate operational disruption.

Who Is Responsible

CISA’s advisory does not attribute the campaign to a specific threat actor. The combination of targeting water infrastructure, the timing, and the method — disruptive rather than destructive — is consistent with hacktivism or state-sponsored disruption operations seeking visible impact without crossing into irreversible damage. Iranian-affiliated actors have previously targeted water sector OT equipment; so have groups with no clear state alignment operating under ideological or opportunistic motivations.

The absence of attribution in CISA’s advisory should not be read as suggesting the campaign is low-priority. The advisory specifically characterises the activity as a “significant escalation” in targeting of water sector devices.

Why the Water Sector Remains Exposed

The water and wastewater sector’s OT security posture reflects structural constraints that are not unique to it but are more acute there than in most other critical infrastructure sectors.

Resource constraints: The majority of US water utilities serve communities of fewer than 10,000 people and operate with IT and OT staff who wear multiple operational hats. Dedicated OT security expertise is rare below a certain scale.

Legacy infrastructure: PLC installations at water utilities often predate meaningful OT cybersecurity guidance. Equipment designed for serial communications has been connected to IP networks through adaptors that were not designed with internet exposure in mind.

Remote access necessity: Water utilities frequently operate geographically distributed infrastructure — pumping stations, storage facilities, treatment plants — that requires remote management. The practical choice has often been “expose it to the internet” or “drive to the site.” Cellular modems and direct internet exposure are common solutions to a legitimate operational problem.

Patching difficulty: Many water utility OT systems run firmware that has not been updated in years, either because the vendor no longer supports the version in use, because patching requires outages that cannot be scheduled, or because the update process is not well-documented and operators are reluctant to risk breaking operational systems.

Required Actions

CISA’s advisory specifies the following immediate actions for water and wastewater utilities:

Remove internet exposure. Every PLC, HMI, and remote terminal unit that is currently directly accessible from the internet should be removed from internet exposure as the first priority. This means firewall rules, not just password changes. A device with default credentials behind a firewall is safer than a device with strong credentials exposed to the internet.

Change all default credentials immediately. Default credentials on OT devices — and on the cellular modems used to connect them — must be changed. The campaign used authenticated access; if default credentials remain in place, the entry requirement is trivially met.

Implement multi-factor authentication. Where remote access is operationally necessary, require MFA before authenticating to OT management interfaces. This applies to the HMI, to the engineering workstation, and to the VPN or remote access gateway used to reach the OT network.

Deploy a DMZ architecture for remote access. Direct connectivity from the internet to PLC interfaces should be replaced with a DMZ pattern: an internet-accessible jump host or remote access gateway that requires strong authentication, which then connects to the OT network through a separate firewall policy. The PLC never sees internet addresses directly.

Enable logging. Configuration changes on PLCs and authentication events on remote access systems should be logged and retained. The campaign involved password and IP address changes — those are configuration events that a properly instrumented system would capture.

For Utilities That Have Already Been Targeted

If your utility has experienced unexplained password lockouts or IP address changes on OT devices in the July 26–August 10, 2026 window, treat this as a potential incident. Steps:

Document the current state of all affected devices before recovering access
Report to CISA via the 24/7 Operations Center and to the FBI
Restore from known-good configurations where backup configurations are available
Conduct a full inventory of internet-exposed OT interfaces before restoring operational connectivity
Contact your sector-specific water security contacts at the Water ISAC (WaterISAC.org)

Wider Implications for OT Operators

The water sector campaign is a reminder that the threat to operational technology is not exclusively advanced persistent threats using sophisticated implants against air-gapped infrastructure. Exposed interfaces with weak or default authentication are accessible to a much broader range of actors, and the operational impact — water service disruption, boil-water notices, manual operations — is real and immediate regardless of attacker sophistication.

Any OT environment with internet-exposed interfaces should treat this advisory as applicable regardless of sector. The attack pattern that works against water utility PLCs works against similarly exposed equipment in manufacturing, energy, transport, and agriculture. The principle — don’t expose control interfaces directly to the internet — is not sector-specific.