Key Takeaways
- At least twelve U.S. states have been hit by a coordinated cyber campaign targeting water and wastewater facilities, though only a few have been publicly named.
- The attackers focus on internet‑exposed Rockwell Automation MicroLogix 1100/1400 PLCs, altering IP addresses, passwords and ladder‑logic files to disrupt monitoring or control functions.
- Reported impacts include temporary loss of water pressure, localized flooding and the need to switch to manual operation; drinking‑water safety has so far remained intact.
- Investigators suspect Iranian state‑linked actors because the tactics match previous Iranian ICS/OT campaigns, but no official attribution has been made.
- Federal agencies (FBI, CISA) urge water utilities to disable unnecessary remote access, enforce strong authentication, segment OT networks, and apply the latest vendor patches.
- Roughly ten thousand Rockwell, Siemens and Schneider PLCs are reachable from the public internet, highlighting a large exposure surface that must be inventoried and secured.
Overview of the Campaign
The recent cyber‑operations targeting water and wastewater infrastructure have spread across a widening swath of the United States. As of the latest reporting, at least twelve states have experienced some form of malicious activity, although only a subset of those jurisdictions have been publicly identified. The attacks appear to be coordinated, focusing on internet‑exposed programmable logic controllers (PLCs) that control pumps, valves and monitoring gear in treatment plants and distribution networks. While no widespread service outages or contamination events have been confirmed, several utilities have reported temporary pressure drops, loss of visibility over field equipment, and the need to switch to manual operation. The evolving list of affected states underscores the growing vulnerability of critical water assets to cyber intrusion.
State‑by‑State Reporting
Minnesota was the first to disclose the campaign, noting that more than thirty community water systems were hit on July 26‑27. Shortly thereafter, Michigan confirmed that a “small number” of its municipalities observed suspicious cyber behavior. South Dakota reported at least one city experiencing a similar intrusion. The Clayton County Water Authority in Georgia announced a temporary disruption that reduced water pressure in parts of its service area; service was restored within hours. Wisconsin utilities have been mentioned in press coverage, but officials have not yet verified any intrusions. New York has not announced whether its systems were compromised, but it did unveil a $9 million grant program to harden 153 water systems against cyber threats. Utah disclosed a March incident involving an oil‑field salt‑water disposal facility’s PLCs, but officials state that event is unrelated to the current wave and no new activity has been detected there.
FBI Alert and Technical Details
On July 30 the Federal Bureau of Investigation issued a cyber advisory confirming that at least seven states had been victimized by the campaign. The alert specified that the threat actors are probing and compromising Rockwell Automation’s MicroLogix 1100 and 1400 series PLCs that are exposed to the public internet. By altering IP addresses, enabling or resetting passwords, and modifying ladder‑logic project files, attackers can erase operators’ view of connected equipment and, in some cases, disrupt control functions. Reported operational effects include loss of water pressure and localized flooding, which could potentially allow untreated groundwater to infiltrate distribution lines. The severity of impact depends on whether the PLC is used for monitoring or actuation, the specific model, the downstream equipment it governs, and the facility’s ability to revert to manual operation. Importantly, the FBI stressed that drinking water quality has remained safe despite the disruptions.
Attribution Speculations and Investigations
Although the United States government has not publicly identified the perpetrators, analysts have quickly pointed to Iran as a likely sponsor. Iranian cyber units have a documented history of targeting industrial control systems, including water‑sector assets, and several private‑sector threat‑intelligence feeds have noted similarities between the current tactics and earlier Iranian campaigns. A non‑public report from the Water Information Sharing and Analysis Center (WaterISAC) allegedly cited evidence that the intrusions are “aligned” with known Iranian activity. Federal investigators are reportedly examining telecommunications logs, malware signatures, and IP‑address geolocations to determine whether Iranian state‑affiliated groups are behind the attacks. Until an official attribution is made, the focus remains on mitigating the technical weaknesses that enabled the intrusions.
Guidance for Defenders and Mitigations
The Cybersecurity and Infrastructure Security Agency (CISA) has urged water‑sector operators to harden their operational technology (OT) environments, with particular emphasis on securing internet‑facing PLCs. Recommendations include disabling unnecessary remote‑access services, enforcing strong, unique passwords, placing PLCs behind firewalls or virtual private networks, and applying the latest firmware patches from Rockwell Automation, Siemens, and Schneider Electric. In April, CISA and partners issued an advisory warning that Iranian threat actors have been probing PLCs from those three vendors; the advisory has been updated to reflect the latest observations. Additionally, the agency encourages participation in information‑sharing hubs such as WaterISAC and the adoption of continuous monitoring tools that can detect anomalous ladder‑logic changes or unauthorized configuration edits in real time.
Exposure Landscape and Supporting Research
Internet‑scanning firm Censys estimates that roughly ten thousand Rockwell, Siemens, and Schneider PLCs are currently reachable from the public internet, though it remains unclear how many of those devices lack basic protections or run vulnerable firmware. Infracritical has published a concise technical briefing that consolidates the known indicators of compromise, network‑traffic patterns, and mitigation steps for the OT security community. Parallel developments in the broader cybersecurity news cycle—such as Rockwell’s recent patch for a code‑execution flaw in its Arena simulation software and studies showing that one‑fifth of data‑center assets are readily accessible to attackers—reinforce the message that legacy industrial equipment often sits at the intersection of inadequate segmentation and unpatched vulnerabilities. Defenders are advised to inventory all OT assets, verify exposure status, and prioritize remediation of any internet‑facing controllers.
Conclusion and Outlook
The expanding roster of states reporting water‑system cyber incidents highlights a persistent and evolving threat to essential public‑health infrastructure. While the attacks to date have caused mainly operational inconveniences—pressure losses, temporary visibility loss, and the need for manual overrides—experts warn that more sophisticated manipulation could jeopardize water safety or service continuity. Attribution remains uncertain, but the convergence of tactics, targeting of specific PLC families, and geopolitical indicators keeps Iran under scrutiny. For water utilities, the immediate priority is to eliminate unnecessary internet exposure, enforce robust authentication, and stay current with vendor patches. Ongoing vigilance, shared threat intelligence, and investment in resilient OT architectures will be crucial to blunt future campaigns and preserve the reliability of the nation’s water supply.