CISA: Over 100 Internet-Exposed Water Systems Targeted in July Cyberattacks

The Cybersecurity and Infrastructure Security Agency (CISA) reported that in July 2026, more than 100 water and wastewater systems in the U.S. were targeted by cyberattacks linked to Iranian threat actors. The attacks exploited internet-exposed programmable logic controllers (PLCs) connected via cellular modems, aiming to disrupt operational technology (OT) systems in the Water and Wastewater Systems (WWS) sector. Although no significant operational disruptions occurred, the attacks underscore the vulnerabilities of OT systems exposed to the internet. CISA's guidance emphasizes identifying and reducing internet exposure, securing remote access, changing default credentials, applying patches, and enforcing multifactor authentication. The advisory also highlights the dangers of leaving PLCs and ICS devices accessible through cellular modems or public internet connections. The affected systems span at least 12 states, including Minnesota, Michigan, South Dakota, Georgia, New Jersey, and Alabama. CISA recommends continuous monitoring and reassessment of network exposure to mitigate ongoing threats.

The cyberattacks targeted over 100 internet-exposed water and wastewater systems, potentially threatening the operational technology controlling critical infrastructure. Although no significant disruptions were reported, the attacks demonstrate the risk posed by internet-exposed PLCs and ICS devices, which could allow threat actors to interfere with water sector operations. The exposure of these systems via cellular modems or public internet increases the attack surface and vulnerability to malicious activity. The incidents highlight the potential for disruption or manipulation of water system controls if adequate security measures are not implemented.

CISA recommends organizations aggressively reduce internet exposure of operational technology systems by first identifying all internet-accessible devices through internal inventories and external scanning. Systems that do not require internet connectivity should have their exposure removed or restricted. For systems that must remain online, CISA advises changing default passwords, applying all relevant security updates, routing remote access through secure gateways or jump hosts, enforcing multifactor authentication, and continuously monitoring network traffic. The guidance specifically warns against leaving PLCs and ICS devices accessible via cellular modems or the public internet. Organizations should perform regular reassessments of network exposure and third-party connections to maintain security posture. No official patch or fix applies as this is an operational security issue rather than a software vulnerability.