Key Takeaways
- Federal agencies (FBI, EPA, CISA) have issued a joint warning after cyber‑attacks disrupted water utilities in Minnesota and other states.
- The primary vulnerability highlighted is internet‑exposed Programmable Logic Controllers (PLCs), especially Allen‑Bradley models made by Milwaukee‑based Rockwell Automation.
- Officials urge water and wastewater utilities to remove PLCs from public‑facing networks, strengthen passwords, and tighten remote‑access controls.
- Wisconsin officials state there are currently no confirmed compromises of state water systems, but they are monitoring the situation closely.
- Local utilities such as Milwaukee Water Works and the Milwaukee Metropolitan Sewerage District report heightened vigilance and confidence in their existing safeguards.
- Rockwell Automation says it is collaborating with customers, partners, and government bodies to address the reported unauthorized activity.
- The advisories underscore a growing trend of threat actors targeting operational technology (OT) that controls critical infrastructure, emphasizing the need for network segregation and continuous monitoring.
Overview of the Federal Warning
On Thursday, the Federal Bureau of Investigation (FBI), the Environmental Protection Agency (EPA), and the Cybersecurity and Infrastructure Security Agency (CISA) released a joint public alert concerning a rise in cyber‑intrusions aimed at water and wastewater facilities. The notice specifically cited malicious actors targeting internet‑facing Programmable Logic Controllers (PLCs) used by utilities in at least seven states. According to the agencies, several of these incidents resulted in measurable operational disruptions, including drops in water pressure and forced shifts to manual control modes. The warning stressed that while no confirmed breaches have been reported in Wisconsin, the pattern of attacks necessitates immediate preventive actions across the sector.
Details of the Cyber Incidents in Minnesota
The advisory was prompted by a series of cyber events that recently affected water utilities in neighboring Minnesota. In those cases, threat actors gained unauthorized access to PLCs that regulate pump stations, chemical dosing, and flow‑control mechanisms. The intrusions led to temporary loss of pressure in distribution networks, compelling operators to revert to manual oversight to maintain service continuity. Although service was restored without public health impacts, the episodes highlighted how a compromise of OT components can cascade into tangible service interruptions, raising alarms about the broader susceptibility of similar systems nationwide.
Nature of the Threat: Exposed PLCs
At the heart of the threat lies the exposure of PLCs to the public internet. Holden, a cybersecurity expert consulted by TMJ4 News, explained that many utilities inadvertently leave these industrial control devices accessible online, effectively broadcasting their internal configurations to anyone with network access. “They are just sitting open on the internet, exposing their internal configurations,” Holden warned. Such exposure enables attackers to probe for default credentials, exploit known vulnerabilities, or manipulate control logic, potentially jeopardizing water treatment processes, pressure regulation, and wastewater treatment efficacy.
Expert Insights from Holden
Holden emphasized that water supply infrastructure should operate on closed, segregated networks rather than being tethered to the internet. He advocated for a “defense‑in‑depth” strategy where OT systems are isolated from corporate IT networks and protected by strict firewalls, intrusion detection systems, and regular patch management. According to Holden, the fundamental principle is to treat PLCs as critical safety components—akin to electrical breakers—whose compromise could have direct consequences for public health and environmental safety.
Recommendations for Utilities
In response to the rising threat, federal and state authorities are urging water and wastewater utilities to take three concrete steps: first, remove any internet‑exposed operational technology (OT) assets from public-facing networks; second, enforce strong, unique passwords and implement multi‑factor authentication for remote access; and third, conduct a thorough review of remote‑access controls, ensuring that only authorized personnel can connect to PLCs and that all sessions are logged and monitored. These measures aim to reduce the attack surface and increase the likelihood of detecting malicious activity before it can affect operations.
Current Status in Wisconsin
Despite the nationwide alerts, Wisconsin officials have reported that, to date, there are no confirmed cyber compromises involving the state’s drinking water or wastewater systems. A spokesperson for the Wisconsin Department of Natural Resources (DNR) told TMJ4 News that the agency will continue to disseminate updates to utilities as new information emerges. The statement underscored a proactive stance: while no incidents have been verified, vigilance remains essential given the evolving threat landscape.
Statements from Milwaukee Water Works and MMSD
Milwaukee Water Works informed TMJ4 that it is aware of the heightened cybersecurity concerns and is actively monitoring its control systems. The utility expressed confidence in the security of its existing infrastructure, citing regular security assessments and adherence to industry best practices. Similarly, the Metropolitan Sewerage District (MMSD) indicated that it is closely watching its OT environment and maintains routine communication with the Department of Homeland Security to stay apprised of emerging threats and mitigation guidance.
Rockwell Automation’s Response
The advisories specifically mention Allen‑Bradley PLCs, a product line manufactured by Rockwell Automation, which is headquartered in Milwaukee. In a statement to TMJ4, the company affirmed that it takes the security of its products seriously and is collaborating with affected customers, partners, and government agencies to investigate reports of unauthorized cyber activity and associated service disruptions. Rockwell Automation pledged to provide technical support, firmware updates, and guidance to help utilities harden their PLC deployments against intrusion.
Broader Implications for Critical Infrastructure
The current wave of PLC‑targeted attacks reflects a broader shift in cyber‑threat tactics toward operational technology that underpins essential services such as water, energy, and transportation. Unlike traditional IT breaches that primarily aim at data theft, OT intrusions can directly impair physical processes, posing risks to public safety, environmental integrity, and economic stability. Consequently, sectors reliant on OT must adopt a holistic security posture that blends network segmentation, continuous monitoring, employee training, and incident‑response planning tailored to the unique constraints of industrial control systems.
Conclusion and Ongoing Vigilance
While Wisconsin’s water utilities have not yet suffered a confirmed breach, the joint federal warning serves as a critical reminder that the threat landscape is evolving rapidly. Utilities are advised to heed the recommendations to isolate PLCs from the internet, fortify authentication mechanisms, and rigorously audit remote‑access pathways. By doing so, they can reduce the likelihood of disruption and ensure that the essential service of delivering safe, clean water remains resilient against cyber adversaries. Continuous collaboration among utilities, regulators, manufacturers like Rockwell Automation, and cybersecurity agencies will be key to safeguarding this vital infrastructure now and in the future.