Full Report
A scan of internet-connected industrial equipment found 4,400 exposed PLCs, including 22 in cities recently targeted by water system attacks. The post Despite federal warnings, thousands of U.S. industrial controllers used in water systems remain exposed online appeared first on CyberScoop.
Analysis Summary
# Incident Report: Exposure and Exploitation of U.S. Water Sector PLCs
## Executive Summary
Multiple water and wastewater utilities across at least 12 U.S. states were compromised by threat actors targeting internet-exposed Programmable Logic Controllers (PLCs). The attacks resulted in operational disruptions, including flooding and loss of water pressure, by manipulating device configurations. Despite federal warnings, over 4,400 industrial controllers remain exposed online, including dozens in recently targeted municipalities.
## Incident Details
- **Discovery Date:** July 2026 (Ongoing monitoring by Forescout/Vedere Labs)
- **Incident Date:** Attacks began approximately July 27, 2026
- **Affected Organization:** Multiple utilities (including sites in Michigan, South Dakota, and Georgia)
- **Sector:** Critical Infrastructure / Water and Wastewater Systems (WWS)
- **Geography:** United States (National scope)
## Timeline of Events
### Initial Access
- **Date/Time:** July 27, 2026
- **Vector:** Direct connection to the public internet via EtherNet/IP (Port 44818) and Modbus TCP.
- **Details:** Attackers used mass scanning to identify Allen-Bradley MicroLogix 1100 and 1400 PLCs that were not protected by firewalls or VPNs.
### Lateral Movement
- **Details:** Limited movement reported; attackers primarily focused on direct interaction with the exposed PLC interfaces to change operational parameters.
### Data Exfiltration/Impact
- **Details:** No significant data exfiltration reported; however, attackers modified IP addresses and passwords on PLCs, locking out legitimate operators. This led to physical impacts, including flooding and pressure loss.
### Detection & Response
- **Discovery:** FBI and EPA confirmed attacks through utility reporting; Forescout identified continued exposure via Shodan scans.
- **Response actions taken:** Joint advisory issued by FBI/EPA; manufacturers (Rockwell Automation) reiterated guidance to disconnect controllers from the public internet.
## Attack Methodology
- **Initial Access:** Exploitation of internet-exposed industrial protocols (EtherNet/IP).
- **Persistence:** Changing administrative passwords and IP addresses to maintain control and prevent owner recovery.
- **Privilege Escalation:** Not applicable (direct administrative access via unauthenticated or weakly authenticated protocols).
- **Defense Evasion:** Opportunistic targeting of "low-hanging fruit" (unprotected devices).
- **Credential Access:** Resetting/changing device passwords.
- **Discovery:** Reconnaissance via Shodan and mass-scanning tools to identify specific PLC models.
- **Lateral Movement:** Minimal; focus was on Impact.
- **Collection:** N/A.
- **Exfiltration:** N/A.
- **Impact:** Remote configuration changes (firmware/logic manipulation) leading to physical process disruption (flooding, pressure loss).
## Impact Assessment
- **Financial:** Unknown; costs associated with emergency response and equipment recovery.
- **Data Breach:** Exposure of system configurations and operational metadata.
- **Operational:** Critical; loss of control over water distribution and wastewater management; physical damage (flooding).
- **Reputational:** Public concern regarding the security of essential municipal services.
## Indicators of Compromise
- **Network indicators:** Traffic on Port 44818 (EtherNet/IP) or Port 502 (Modbus) from unauthorized external IPs.
- **File indicators:** Unauthorized configuration files or logic updates to PLCs.
- **Behavioral indicators:** Sudden loss of visibility into PLC telemetry; unauthorized changes to device IP addresses; inability for operators to login with known credentials.
## Response Actions
- **Containment:** Disconnecting affected PLCs from the public internet.
- **Eradication:** Factory resetting compromised PLCs and restoring logic from known-good backups.
- **Recovery:** Restoring local operator control and implementing firewall/VPN protections.
## Lessons Learned
- **Visibility Gaps:** Utilities are still failing to identify all internet-facing assets.
- **Warning Fatigue:** Despite manufacturer warnings dating back to 2018, thousands of devices remain exposed.
- **Legacy Vulnerabilities:** Many exposed devices (MicroLogix 1400) are susceptible to old vulnerabilities (CVE-2017-16740).
## Recommendations
- **Asset Inventory:** Conduct immediate scans to identify all internet-facing ICS/OT equipment.
- **Network Segmentation:** Place all PLCs/controllers behind a firewall and require a secure VPN with Multi-Factor Authentication (MFA) for remote access.
- **Disable Protocols:** Disable Modbus TCP and other unencrypted protocols if they are not strictly necessary.
- **Update Firmware:** Ensure all PLCs are running the latest security patches to mitigate known remote code execution flaws.