A coordinated wave of cyberattacks has disrupted municipal water systems across at least seven states, forcing some utilities to switch to manual operations and triggering boil water notices. The attacks target the same class of exposed industrial controllers that CISA has been warning about for months, but the volume and coordination this time are different. More than 30 community water systems in Minnesota were hit in a single weekend, and federal officials say the scope is still growing. If you operate water infrastructure, the time for risk assessments has passed. This is an active campaign against exposed programmable logic controllers, and the defense is the same whether the attacker is a nation-state or a script kiddie with a Shodan subscription. We have covered the earlier CISA alert on PLC attacks against water utilities before. The threat has now escalated from advisory to incident.
PLC attacks on water utilities have moved from theoretical risk to active, multi-state disruption, and CISA is telling every operator to pull exposed controllers off the internet immediately.
What happened in the Minnesota water attacks?
Minnesota IT Services activated the state's cybersecurity incident response plan after identifying what it described as a coordinated cyberattack targeting operational technology at more than 30 community water systems. The attacks played out over Sunday night, July 27, and continued through Monday morning, hitting utilities of varying sizes across the state.
The attackers' methods were straightforward but effective. According to the joint FBI and EPA advisory, malicious actors remotely accessed internet-facing devices, changed passwords to lock operators out, and modified IP addresses to disconnect devices from the internet. Some utilities lost monitoring and control capabilities entirely. In Braham, Minnesota, an intrusion briefly knocked out controls for the city's well and water treatment plant, according to Nextgov/FCW. Multiple municipalities reported equipment malfunctions that forced temporary manual operations.
A memo from the Minnesota Bureau of Criminal Apprehension, obtained by CNN, said the "likely desired impact" of the intrusion was "to cause loss of system pressure and subsequent potential contamination of water supply." Officials in Minnesota said they found no evidence that drinking water quality was affected. But CISA noted separately that some larger attacks on water infrastructure had resulted in boil water notices and sustained manual operations, without specifying where those incidents occurred.
The investigation is still active. Minnesota officials and the FBI have not publicly attributed the attacks to a specific actor. The Minnesota Fusion Center cited characteristics "aligned" with a campaign described in CISA's April advisory involving Iran-linked hackers, though the bulletin explicitly says it does not present direct evidence attributing the Minnesota incident to Iran. Attribution requires careful technical analysis, and federal partners are leading that work. The lack of a named culprit should not slow your response.
How exposed is the water sector's operational technology?
The scale of the attack surface explains why this campaign spread so fast. Censys, a cybersecurity exposure management company, quantified the internet exposure of industrial controllers and found more than 4,100 internet-exposed Rockwell Automation and Allen-Bradley hosts, roughly 4,100 Siemens hosts, and over 2,000 Schneider Electric hosts. These are devices reachable over the public internet, not necessarily systems that have been compromised. But "reachable" is all an attacker needs to begin trying default credentials.
The chart above shows the three manufacturers with the largest exposed footprint, based on Censys scan data from July 2026. Rockwell and Siemens each top 4,100 exposed hosts, while Schneider Electric exceeds 2,000. CISA's bulletin specifically names Rockwell Automation MicroLogix 1400 PLCs as a device of concern.
The geographic spread of exposed Rockwell devices is particularly notable. Censys reported that nearly half of the exposed Rockwell devices are reachable via cellular networks including Verizon Business, AT&T, T-Mobile, Comcast, Charter, and Starlink. These connections often come from undocumented cellular modems installed by operators, vendors, or system integrators who needed remote access and took the fastest path to get it.
That blind spot matters operationally. If your IT security team does not know a modem exists, it cannot monitor the traffic, patch the firmware, or segment the device. The CISA bulletin specifically calls out these undocumented modems as a common entry point for attackers. A system integrator installs a cellular modem for convenience during commissioning, documents it on a napkin that gets lost, and five years later that modem is the only internet-facing path into your water treatment controls.
Why are these PLCs so easy to compromise?
The technical reality is ugly. Many of the targeted controllers are running firmware that vendors no longer sell, let alone actively patch. Censys noted that many exposed MicroLogix 1400 controllers, the specific model CISA flagged, are running end-of-sale firmware versions. That means no vendor support, no security patches, and no roadmap for fixing vulnerabilities that researchers may find tomorrow.
The attack pattern itself does not require sophisticated exploits. The attackers are not chaining zero-days or building custom malware. They are logging into devices with default or weak credentials, changing passwords to lock out legitimate operators, and modifying network configurations to sever remote access. This is the operational technology equivalent of walking through an unlocked door and changing the lock.
CISA's April advisory, updated on July 22, described a campaign with characteristics aligned with Iran-linked hackers. The FBI and EPA did not identify a culprit behind the breaches in the other states. Roughly six or seven states have reported related cyber incidents over the past week, according to sources familiar with the investigation. Wisconsin's Department of Natural Resources issued its own bulletin warning that systems within the state may be susceptible. The number of affected states may grow as more utilities check their systems and report findings.
The timing is not coincidental. The Minnesota attacks came just days after U.S. officials publicly warned that Iran-backed hackers were targeting critical infrastructure amid escalating conflict between Washington and Tehran. Whether this campaign is state-directed, state-enabled, or purely opportunistic actors copying a public playbook, the mitigation path is identical.
What should water utility operators do right now?
CISA's guidance is direct and leaves little room for interpretation. If you run water or wastewater systems, here is the priority order:
- Remove PLCs and OT from direct internet exposure immediately. This is the single most effective action. If a device is not reachable from the public internet, this attack pattern fails. CISA urges this as the first step for organizations of all sizes, including those with mature cybersecurity programs.
- If you cannot remove a device, put it behind a VPN or secure gateway. Direct exposure is the problem. A gateway with proper authentication and network segmentation is the minimum acceptable fallback.
- Change default passwords on every controller. The attackers in this campaign relied on default or weak credentials. This takes minutes per device and breaks the attack chain at the first step.
- Implement IP address allow-lists. Limit which addresses can reach your controllers. If only two maintenance workstations need access, allow only those two addresses and block everything else.
- Inventory undocumented cellular modems. Walk your sites, ask your integrators, and find every modem that someone installed without telling IT. If a modem connects a PLC to a cellular network, that PLC is internet-exposed even if your firewall rules say otherwise.
- Hunt for indicators of compromise. Censys published an expanded set of IoCs and threat-hunting guidance in its report. Check for changed passwords, modified IP configurations, and unexpected login activity on any controller that was previously exposed.
For operators running Rockwell Automation MicroLogix 1400 PLCs specifically, CISA pointed to vendor recovery guidance for regaining access if attackers have changed passwords. If you find a controller that you can no longer authenticate to, do not assume it is simply broken. Assume it is compromised until proven otherwise.
If this advice sounds basic, that is the point. The attacks succeeding right now exploit devices that have no defenses at all. A PLC sitting on the public internet with a default password is not a sophisticated attack surface. It is an open door with a sign that says "water treatment controls here."
What comes next for the water sector?
The FBI, EPA, and CISA are coordinating on a sector-wide push, and Congressional scrutiny of water sector cybersecurity is intensifying. The UK's BBC also covered the U.S. alert, indicating international attention on the scope of the campaign. If you operate in this sector, expect pressure from regulators and insurers to demonstrate that your OT is not sitting on the public internet.
The bet worth making: assume your exposed controllers are already on a target list. Censys data shows thousands of devices are discoverable through routine internet scans. Attackers do not need to hunt for them. They need only to pick from the list. If you have not already pulled your PLCs off the internet, do it today, not next quarter. The cost of segmentation is measured in engineering hours. The cost of a boil water notice and sustained manual operations is measured in community trust.
The bet not worth making: waiting for attribution. Whether these attacks are state-sponsored, state-enabled, or opportunistic does not change your mitigation path. The defense is the same. The urgency is the same. The attacker changed a password and an IP address. Your response is to remove the device from the internet and change the password yourself.
For teams that manage broader OT environments beyond water, the lesson generalizes. Any PLC, SCADA system, or industrial controller that is reachable from the public internet is a candidate for this attack pattern. The water sector is the target today. Tomorrow it could be energy, manufacturing, or transportation. The exposure data from Censys covers multiple sectors, and the attack methodology transfers directly.
The Kicker
Thirty water systems were disrupted in two days across one state, with incidents now reported in seven. The method was logging into exposed controllers with default passwords and changing the locks. If your industrial controls are still reachable from the public internet, the next headline could be your facility.
