Full Report
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning of a significant increase in attacks targeting internet-exposed programmable logic controllers (PLCs) in the water and wastewater systems sector. [...]
Analysis Summary
# Incident Report: Targeted OT Attacks on U.S. Water and Wastewater Systems
## Executive Summary
In late July 2026, a coordinated cyberattack targeted internet-exposed Programmable Logic Controllers (PLCs) across more than 30 community water systems in Minnesota. Threat actors exploited publicly reachable Operational Technology (OT) to lock out operators, modify device configurations, and disrupt water utility services. While many systems were forced into manual operations, CISA and state agencies intervened to provide recovery guidance and urge the immediate removal of OT assets from the public internet.
## Incident Details
- **Discovery Date:** July 26, 2026 (Approximate)
- **Incident Date:** July 26 – July 27, 2026
- **Affected Organization:** 30+ Community Water Systems; Rockwell Automation MicroLogix 1400 users
- **Sector:** Water and Wastewater Systems (WWS) / Critical Infrastructure
- **Geography:** Minnesota, USA (and broader U.S. exposure)
## Timeline of Events
### Initial Access
- **Date/Time:** Sunday, July 26, 2026
- **Vector:** Public Internet Exposure / Unprotected Cellular Modems
- **Details:** Attackers identified PLCs reachable via the public internet, often connected through cellular modems (Verizon, AT&T, Starlink, etc.) or undocumented network entry points.
### Lateral Movement
- **Details:** Not explicitly detailed in the report; however, the attack focused on direct interaction with internet-facing OT controllers and cellular gateways.
### Data Exfiltration/Impact
- **Details:** No data exfiltration reported. Impact was localized to operational disruption: unauthorized password changes (lockouts) and modification of IP addresses to disconnect devices from legitimate management networks.
### Detection & Response
- **Detection:** Identified by Minnesota IT Services (MNIT) and local utility operators following equipment malfunctions.
- **Response:** MNIT activated the state’s cybersecurity incident response plan. CISA issued an urgent national alert on July 30, 2026. Affected utilities switched to manual operations to maintain water services.
## Attack Methodology
- **Initial Access:** Exploitation of internet-exposed OT devices and cellular modems.
- **Persistence:** Changing administrative passwords to prevent legitimate operator re-entry.
- **Privilege Escalation:** Use of default credentials or lack of authentication on exposed PLC interfaces.
- **Defense Evasion:** Not heavily emphasized; attackers relied on the lack of basic perimeter security.
- **Credential Access:** Resetting or changing passwords on Rockwell Automation MicroLogix 1400 PLCs.
- **Discovery:** Scanning for common OT ports (Rockwell/Allen-Bradley, Siemens, Schneider Electric).
- **Lateral Movement:** N/A (Direct access to target controllers).
- **Collection:** N/A.
- **Exfiltration:** N/A.
- **Impact:** Configuration manipulation, operational disruption, and locking out authorized personnel.
## Impact Assessment
- **Financial:** Costs associated with emergency response, manual labor for onsite overrides, and forensic recovery.
- **Data Breach:** None reported.
- **Operational:** Over 30 utilities suffered disruptions; equipment malfunctions necessitated a shift to manual operation.
- **Reputational:** Increased public concern regarding the security of critical utility infrastructure.
## Indicators of Compromise
- **Network Indicators:** Unauthorized IP address changes on PLC interfaces; traffic originating from unknown external IPs to OT ports.
- **File Indicators:** Not reported.
- **Behavioral Indicators:** Sudden loss of administrative access to PLCs; "locked out" status; devices disappearing from management consoles due to IP modifications.
## Response Actions
- **Containment:** Disconnecting exposed PLCs from the public internet; switching to manual water treatment/distribution processes.
- **Eradication:** Utilizing Rockwell Automation vendor guidance to reset/recover hijacked PLC accounts.
- **Recovery:** Restoring normal operations through MNIT threat intelligence and best practices guidance.
## Lessons Learned
- **Visibility Gaps:** Undocumented cellular modems installed by third-party vendors or operators create significant "shadow OT" risks.
- **Legacy Vulnerabilities:** Many targeted devices (MicroLogix 1400) were running End-of-Sale (EoS) firmware, making them easier targets.
- **Criticality of Manual Overrides:** The ability to switch to manual operations prevented a total loss of service to the community.
## Recommendations
- **Network Hardening:** Immediately remove all PLCs and OT assets from the public internet.
- **Secure Access:** If remote access is required, utilize a VPN with Multi-Factor Authentication (MFA).
- **Access Control:** Change all default passwords and implement IP address allow-listing (firewalling) for all OT interfaces.
- **Inventory Management:** Conduct a thorough audit of all field sites to identify and secure undocumented cellular modems or rogue internet connections.
- **Firmware Updates:** Ensure all PLCs are updated to the latest supported firmware versions to mitigate known vulnerabilities.