/01What happened
On July 30, 2026, the FBI and EPA warned that malicious cyber actors were attacking operational technology at water and wastewater utilities. Since July 27, utilities in at least seven states had reported incidents to the FBI, and some of the activity degraded water operations.
The attackers reached Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 PLCs that were exposed to the internet. They changed the controllers’ IP addresses and turned on and set passwords, so operators lost their view of connected equipment and, in some cases, control of it. At least one utility found modified project files after noticing ladder logic discrepancies across several sites.
Publicly, Minnesota reported malicious activity against technology at more than 30 community water systems, and Michigan reported attacks on nine systems, which were operating safely. The FBI alert does not name the states or say who was responsible. A week earlier, on July 22, CISA had warned of ongoing Iranian-affiliated targeting of internet-connected operational technology.
/02What it did to operations
Reported effects included loss of pressure and flooding. The FBI and EPA noted that pressure loss can let untreated groundwater seep into pipes.
How badly each utility was hurt depended on what the PLC did, whether it monitored or controlled equipment, which model it was, and whether operators could switch to manual operation.
/03Why it worked
- The PLCs were reachable from the internet, with no secure gateway or firewall in front of them.
- Some were reachable through cellular modems installed by operators, vendors or integrators, which CISA warned may not be documented or caught by routine scans.
- The same network setups, provided by the same third parties, were repeated across customers, so one weakness worked in many places.
- Older and end-of-life controllers no longer receive security updates, and the FBI and EPA say they are routinely targeted.
/04What to check this week
From the FBI and EPA guidance:
- Find every PLC reachable from the internet, including through cellular modems your vendors installed, and remove the exposure. If you need remote access, broker it through a secure gateway.
- Secure cellular modems with strong authentication and current firmware, and review their logs for suspicious activity.
- Set complex, unique passwords on every PLC.
- Restrict network access to PLCs with firewall rules or access control lists, and block IP addresses belonging to hosting providers.
- Validate each project file, then put physical and software key switches in RUN, which blocks changes to logic, configuration and firmware.
- Practice running the plant in manual, and test your fail-safes, backups and standby systems.
- Compare the logic running on each PLC with a known-good copy, and check backups for malicious logic before restoring them.
- Review logs on modems, HMIs and workstations for signs the attackers moved further, and reimage anything they touched.
- Keep a rolling 12-month end-of-life forecast, and replace or isolate end-of-life controllers.
/05If you have been hit
Contact your local FBI field office and file a complaint at ic3.gov, and contact CISA at contact@cisa.dhs.gov or 1-844-SAY-CISA (1-844-729-2472). Include PLC model numbers, serial numbers and IP addresses, and any unusual IP addresses seen on networks connected to the PLCs.
New Jersey water systems must also report cybersecurity incidents to the NJCCIC promptly under the Water Quality Accountability Act. Rockwell Automation’s product security team takes reports at PSIRT@rockwellautomation.com.
In New York, community water systems serving more than 3,300 people must report incidents to NYSDOH within 24 hours, and wastewater permit holders must report to the Department of Environmental Conservation within 24 hours. Water and Wastewater Agency Response Networks (WARN) can also provide mutual aid. See every reporting channel.
/06How Culper-I would have seen it
Culper-I‘s passive inventory shows every controller and modem on your control network, including the ones nobody documented, and flags any that are reachable from the internet. It alerts our SOC when a PLC’s IP address, password or logic changes, and our analysts call your operator and help your team run in manual while the problem is contained. The result is water and wastewater compliance. See the rules it covers.
