In late July 2026, more than 25 water utilities across seven states reported cyber incidents linked primarily to internet-facing Programmable Logic Controllers (PLCs), weak access credentials, and vulnerable software versions. The FBI and EPA are involved, and the latest FBI alert is available here: Malicious Cyber Actors Targeting Water and Wastewater Sector Internet-Facing Programmable Logic Controllers, Causing Operational Disruptions — FBI.
CISA, EPA, WaterISAC, and other partner agencies have raised these risks for years across multiple forums. However, progress in hardening PLCs and reducing internet exposure has lagged behind other critical infrastructure sectors, including energy, financial services, and healthcare. As the sector continues to address these vulnerabilities, it is important to examine how water and wastewater technologies and the workforce that supports them differ from other critical infrastructure environments.
Operational Technology Sophistication
The complexity of water operations is driven primarily by volume, pressure requirements, and distribution design. According to the Environmental Protection Agency (EPA), small Public Water Systems (PWSs)—those serving 10,000 or fewer customers—represent 92% of the nation’s approximately 51,000 Community Water Systems (CWSs).
Using a simple “T-shirt sizing” model, small water operations typically have the least technology sophistication. They may operate with no more than five PLCs, two Human Machine Interfaces (HMIs), and fewer than 25 total OT assets. These assets are often spread across a limited geographic radius and connected through a flat network segment.
Medium and large utilities usually operate more sophisticated environments, including interconnected hub-and-spoke networks, Supervisory Control and Data Acquisition (SCADA) systems, security controls that protect PLCs, and monitoring capabilities designed to detect malicious activity.
Over the past decade, budget constraints, limited use of available grants, and exceptions to EPA compliance requirements have widened the modernization and security gap between smaller and larger utilities. As a result, many water utilities have become comparatively soft targets for threat actors.
Cybersecurity Controls for Industrial Control Systems
Many modern security controls originated in Information Technology (IT) environments and gained prominence after major cyber incidents, particularly in the financial services and healthcare sectors between 2015 and 2021. These incidents helped shape the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA). However, CIRCIA’s reporting requirements and adoption are still not fully effective, and numerous exclusions remain, including for certain categories of water and wastewater operations.
OT security architecture is unique across critical infrastructure sectors. For example, a defense-in-depth model for the electric grid differs substantially from one designed for a gas pipeline. The National Institute of Standards and Technology (NIST) has done strong work categorizing these controls, while federally funded Information Sharing and Analysis Centers (ISACs) help translate them into sector-specific guidance. For water and wastewater utilities, WaterISAC provides tailored guidance for organizations of different sizes.
Control Room Workforce Transformation
Like other critical infrastructure sectors, water and wastewater control room operations are experiencing workforce transformation, including a significant reduction in available operators. Medium and large utilities have generally managed workforce attrition (driven by retirements and consolidation) by automating specific operations and improving control room monitoring.
Smaller utilities, however, are struggling to sustain operations, especially after the disruptions that began during the 2020 pandemic. According to the New Jersey Water Association, the water industry is expected to lose more than 50% of its licensed operator workforce. Apprenticeship programs across many states have recognized the growing need to replace experienced employees, and large utilities such as American Water and Veolia Workforce Academy have developed training and license certification programs to support this demand.
Path Forward
Defending the nation’s water and wastewater systems requires a defense-in-depth approach that brings together people, process, and technology. That approach must be tailored to the sector, scalable across utilities of all sizes, and capable of supporting resilient, reliable controls that can be implemented consistently.
Learn how Digital Team Six has been transforming Water and Wastewater Operations Resiliency and Cybersecurity
