CISA warns of PLC attacks on water utilities
CISA reports a surge in attacks against internet-exposed PLCs in the water sector, with actors locking out operators and disrupting service.
Sourcecisa.gov — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
CISA has issued an alert describing a marked increase in threat activity targeting programmable logic controllers (PLCs) within the Water and Wastewater Systems Sector. Attackers are gaining access to publicly exposed PLCs and OT devices—including undocumented cellular modems installed by vendors or integrators—then changing default or existing passwords to lock out legitimate operators and altering IP configurations to sever remote connectivity. This activity has already caused boil water notices and forced some utilities into sustained manual operations, indicating real operational impact rather than opportunistic defacement alone.
The advisory notes that targeting is indiscriminate across utility size and maturity, meaning even organizations with established cybersecurity programs may be exposed via undocumented remote-access hardware that falls outside routine attack surface scans. CISA specifically references Rockwell Automation MicroLogix 1400 controllers, pointing operators to vendor guidance for recovering access when passwords have been changed by an unauthorized party.
Mitigation guidance focuses on immediately removing PLCs from direct internet exposure, routing remote access through VPNs or gateway devices, enforcing password protection, and allowlisting IPs to known engineering assets. CISA also recommends maintaining clean PLC image backups in case of lockout. No specific threat actor, malware, or CVE has been attributed to this activity; the alert is a sector-wide warning based on observed operational patterns rather than a single confirmed intrusion set.
Source reporting: https://www.cisa.gov/news-events/alerts/2026/07/30/cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs
Free public brief. The indicators are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs