Full Report
In light of the water-sector activity described below, we've increased monitoring for related indicators of compromise across our client environments. Please contact your LevelBlue account team with questions specific to your environment.
Analysis Summary
# Incident Report: July 2026 Targeted Attacks on U.S. Water and Wastewater Systems
## Executive Summary
In late July 2026, a coordinated cyber campaign targeted over 30 community water systems in Minnesota and several other U.S. states, focusing on internet-facing Operational Technology (OT). Attackers exploited exposed Programmable Logic Controllers (PLCs) to alter configurations, causing loss of visibility, pressure disruptions, and localized flooding. While sharing technical overlaps with Iranian-affiliated activity, the campaign highlights a broader trend of hacktivist and state-sponsored targeting of insecure critical infrastructure.
## Incident Details
- **Discovery Date:** July 27, 2026
- **Incident Date:** July 27 – August 3, 2026
- **Affected Organization:** 30+ Minnesota water systems; utilities in 7+ other states and Canada.
- **Sector:** Water and Wastewater Systems (WWS) / Critical Infrastructure
- **Geography:** United States (primarily Minnesota) and Canada
## Timeline of Events
### Initial Access
- **Date/Time:** July 27, 2026 (ongoing through early August)
- **Vector:** Exploitation of internet-facing OT hardware and remote-access services.
- **Details:** Attackers targeted Rockwell Automation and Allen-Bradley MicroLogix 1100/1400 PLCs, cellular modems, and Human-Machine Interfaces (HMIs) exposed to the public internet.
### Lateral Movement
- **Details:** The campaign leveraged common network configurations provided by third-party vendors, allowing attackers to use similar methods across multiple utilities with identical remote-access architectures.
### Data Exfiltration/Impact
- **Details:** Attackers remotely changed PLC IP addresses and passwords to lockout legitimate operators. In some cases, PLC project files were modified, and "ladder logic" (the code controlling physical processes) was altered.
### Detection & Response
- **Discovery:** Identified by operators via loss of control, visibility discrepancies, and physical indicators (flooding/pressure loss).
- **Response Actions:** Organizations transitioned to manual operations; federal agencies (CISA, FBI, EPA) issued Joint Cybersecurity Advisory AA26-097A.
## Attack Methodology
- **Initial Access:** Targeting of exposed, internet-connected PLCs and cellular modems.
- **Persistence:** Changing administrative passwords and IP addresses to maintain control and exclude authorized personnel.
- **Privilege Escalation:** Use of default credentials or lack of authentication on OT interfaces.
- **Defense Evasion:** Modifying PLC project files to hide logic changes.
- **Discovery:** Scanning for internet-facing industrial control system (ICS) hardware.
- **Impact:** Manipulation of physical processes including pumps, valves, and chemical dosing; caused loss of water pressure and physical flooding.
## Impact Assessment
- **Financial:** Costs associated with emergency manual staffing and equipment remediation.
- **Data Breach:** Compromise of operational logic and configuration files; no specific PII breach mentioned.
- **Operational:** Loss of automated control; reliance on stored water; physical disruption of distribution systems.
- **Reputational:** High public concern regarding the safety and reliability of municipal drinking water.
## Indicators of Compromise
- **Network indicators:**
- Unauthorized access from suspicious external IP addresses (e.g., [x].[x].[x].[x]).
- Unexpected changes to PLC IP configurations.
- **File indicators:** Modified ladder logic or PLC project files.
- **Behavioral indicators:** Discrepancies between HMI readings and physical equipment status; lockout of administrative accounts.
## Response Actions
- **Containment:** Disconnecting affected PLCs from the public internet.
- **Eradication:** Factory resetting compromised PLCs and restoring logic from known-good backups.
- **Recovery:** Resumption of automated services after verifying integrity of logic and changing all administrative credentials.
## Lessons Learned
- **OT Exposure:** Internet-facing PLCs remain an easy target; sophisticated malware is not required when legitimate engineering tools can be used for harm.
- **Supply Chain Risk:** Third-party providers often implement identical, insecure configurations across multiple clients, creating a "single point of failure" for a geographic region.
- **Manual Resiliency:** The ability to revert to manual operations was the primary factor in preventing a public health crisis.
## Recommendations
- **Remove OT from Public Internet:** Ensure PLCs and HMIs are not accessible via the public web; use cellular modems only with private APNs or VPNs.
- **Implement MFA:** Require Multi-Factor Authentication for all remote access to the OT network.
- **Change Default Credentials:** Immediately update all default factory passwords on industrial hardware.
- **Logic Integrity:** Maintain offline backups of PLC ladder logic and perform regular integrity checks against the running code.