Water and wastewater utilities in at least seven U.S. states have reported cyber incidents involving internet-exposed industrial controllers, turning a long-running warning about critical infrastructure into an active operations problem for local water systems.
The FBI and Environmental Protection Agency issued a public service announcement on July 30 warning that malicious actors are targeting operational technology devices, including Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers. Since July 27, the agencies said, utilities in at least seven states have reported incidents, and some activity degraded water operations.
The clearest public case so far is Minnesota. Minnesota IT Services said a coordinated cyberattack targeted operational technology at more than 30 community water systems on July 26 and 27, prompting a statewide cybersecurity response with local utilities, state agencies, CISA, the EPA and the FBI. The Minnesota Department of Health said at the time that it was not aware of active requests for residents to modify drinking-water usage.
That distinction matters: this is not a confirmed drinking-water contamination event. It is a control-system exposure event. The danger is that attackers can interfere with the digital devices utilities use to monitor pumps, tanks, pressure, lift stations and treatment equipment, forcing operators into manual workarounds or creating unsafe operating conditions if a facility is not prepared.
What federal agencies say attackers changed
In the FBI and EPA warning, the agencies described a direct and familiar attack path: remote access to internet-facing PLCs, followed by configuration changes that caused operators to lose monitoring and control. The reported changes included modified IP addresses and passwords. In some cases, federal officials said, attackers enabled or changed passwords, causing a loss of view and sometimes loss of function for connected equipment.
The agencies said they had observed the behavior on Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 devices, while cautioning that the same risk logic applies to other PLC brands when they are reachable from the internet. At least one organization reported modified PLC project files after finding ladder-logic discrepancies across several sites.
The operational effects were not theoretical. The FBI and EPA said reported impacts included pressure loss and flooding. Pressure loss can create a water-quality risk because untreated groundwater can potentially seep into pipes when pressure drops. The actual effect at any facility depends on what the PLC controls, whether it is used only for monitoring or direct control, whether connected equipment can be isolated, and whether staff can move quickly to manual operation.
Minnesota shows the small-utility problem
Public reporting from Minnesota shows how the same technical weakness can create different operational problems across municipalities. CBS News reported that South St. Paul shifted to contingency procedures and manual operations after detecting an issue early Monday, while drinking-water treatment, pressure, quality and delivery were not affected. Braham isolated an affected system, restored a backup and restarted a plant in about 90 minutes after workers noticed a well supplying the city’s water tower was malfunctioning.
Plymouth officials detected compromised PLCs at two water towers and 14 sewer lift stations, then disconnected the devices from the cellular network, according to the same report. Communications were restored by Tuesday afternoon, and city officials said water treatment, quality, pressure and delivery remained uninterrupted.
The pattern is important because many small and mid-size utilities rely on remote monitoring through vendors, cellular modems, field devices and legacy control gear. Those connections can be useful and sometimes necessary, but they can also sit outside ordinary IT inventories and attack-surface scans. A water utility may believe its main network is not exposed while a cellular modem, vendor-installed controller or poorly documented remote access path remains reachable.
Attribution is still unsettled
Investigators are examining whether Iranian-linked hackers were involved, but officials have not made a final public attribution. CBS News reported that U.S. officials and people familiar with the incident were probing that possibility while cautioning that the assessment could change as more technical evidence is collected. The Associated Press also reported that the FBI had not publicly identified a culprit.
Iran-linked actors have a documented history with water-sector targets. Federal agencies previously attributed 2023 activity against multiple U.S. water and wastewater facilities to actors affiliated with Iran’s Islamic Revolutionary Guard Corps, including intrusions involving internet-connected controllers that retained weak or default access settings. That history makes Iranian involvement plausible, but it does not remove the need for evidence in the current cases.
For utilities, the immediate defense work does not depend on attribution. Whether the actor is state-linked, criminal, opportunistic or trying to mimic another country, the exposure being exploited is the same: operational technology that can be reached and changed remotely without enough mediation, authentication, logging and segmentation.
What utilities should check now
The first job is to find exposed controllers before attackers do. Utilities should identify PLCs, remote terminal units, human-machine interfaces, engineering workstations, telemetry devices and cellular modems that have direct inbound exposure from the public internet. The FBI and EPA recommend removing PLCs from direct public access and routing remote access through secure gateways, firewalls and controlled jump hosts.
Cellular connectivity deserves special attention. CISA warned that the current targeting includes cellular modems installed by operators, vendors or system integrators that may not appear in routine scanning. Utilities should inventory SIM-connected and carrier-connected devices, review modem logs, update modem firmware where available, require strong authentication, and consider private APNs, VPNs, ZTNA or other isolated remote-access designs instead of open inbound access.
Operators should also verify controller passwords and access-control lists. Shared, default or vendor-reused passwords are especially dangerous in a sector where the same integrator may have installed similar configurations across multiple sites. Firewall rules and PLC-level access controls should allow only expected communications between known devices, management systems and authorized support paths.
For Rockwell and similar PLC environments, agencies recommend placing physical or software key switches in the run position when devices are not being updated. That step can help block unauthorized logic, firmware or configuration changes, but it should be done carefully: before locking in a running state, operators should review and validate project files so they do not preserve a malicious or incorrect configuration.
Manual operation is not a fallback to improvise during an incident. Utilities should test whether staff can keep essential service running when remote monitoring, automated alerts or SCADA visibility fail. That means exercising manual procedures, validating backups, checking fail-safe mechanisms, and confirming that operators have current diagrams, contact lists and local access to equipment.
The bigger lesson for critical infrastructure
The water sector is a hard cybersecurity environment because many systems are small, geographically distributed and resource-constrained. A large software company can centralize security engineering; a rural utility may have a tiny staff, a vendor-managed control panel and equipment that was designed for reliability long before public-internet exposure became a normal risk.
That makes federal warnings easy to issue and harder to execute. Removing exposed PLCs is the right direction, but it requires a clear asset inventory, vendor coordination, remote-access redesign, operator training and enough funding to replace or isolate end-of-life hardware. The FBI and EPA also recommend keeping a rolling 12-month forecast of end-of-life devices, reviewed quarterly with owners and procurement teams.
The Minnesota incidents show why water cybersecurity can no longer be treated as a paperwork exercise. When a controller password, modem or remote-access route fails, the consequence is not only a network alert. It can be a pump offline, a tower not filling, a lift station disconnected, a plant running manually, or a utility racing to prove that water quality and pressure remained safe.
For the public, the important point is not panic. It is that the invisible technology behind basic services now needs the same disciplined exposure management that enterprises apply to cloud systems and identity platforms. For water operators, the practical test is simple and urgent: if a PLC, modem or control interface can be found from the internet, it needs to be removed, mediated or isolated before the next scan becomes the next incident.
Sources: FBI/EPA public service announcement; Minnesota IT Services response notice; CBS News reporting; Associated Press reporting.
