The US Cybersecurity and Infrastructure Security Agency (CISA) issued an alert following coordinated cyber intrusions that impacted operational technology in water and wastewater utilities in Minnesota. The attackers targeted internet-exposed programmable logic controllers (PLCs), modifying passwords to lock out operators and changing IP addresses to disconnect devices. These attacks caused operational disruptions including boil water notices and forced manual operations. The alert highlights that threat actors, including Iran-linked groups such as CyberAv3ngers and Handala, have been observed targeting PLCs from vendors like Rockwell Automation, Schneider Electric, and Siemens. CISA urges utilities to remove PLCs from direct internet exposure, implement VPN or gateway-based remote access, enable password protections, and restrict access via IP allowlisting. The alert also stresses the importance of identifying undocumented cellular modems that may be overlooked in security scans. While investigations continue, no formal attribution has been made, and no known exploits in the wild have been reported.

The attacks disrupted automated control functions at dozens of water utilities, leading to boil water notices and sustained manual operations. Although water safety was maintained, the incidents caused operational challenges and highlighted vulnerabilities in internet-exposed OT devices. The targeting affects water entities of all sizes and can result in loss of remote control over critical infrastructure components, increasing operational risk and potential safety concerns.

CISA recommends immediate disconnection of PLCs from direct internet exposure and routing remote access through VPNs or gateway devices. Operators should enable password protection on PLCs, change default passwords, and implement IP allowlisting to restrict remote access to known devices. Utilities should maintain known-clean backups of PLC images to recover from potential lockouts caused by password changes. Owners of Rockwell Automation MicroLogix 1400 controllers should follow Rockwell's guidance for restoring access if passwords are unknown. Utilities are also advised to review CISA advisory AA26-097A for tactics, techniques, and indicators of compromise to detect current or past intrusions. No official patch is indicated; securing network exposure and access controls is the primary mitigation.