NewsPublished 31 Jul 2026

CISA warns of cyberattacks disrupting U.S. water utilities

Source Bleeping Computer

Description

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning of a significant increase in attacks targeting internet-exposed programmable logic controllers (PLCs) in the water and wastewater systems sector. [...]

Impact

The attacks have caused operational disruptions at multiple water utilities, forcing some to switch to manual operations temporarily. The compromise of PLCs can lead to loss of control over water system processes, potentially affecting water treatment and distribution. The exposure of PLCs to the internet increases the risk of unauthorized access, configuration changes, and operational downtime. While no physical damage has been confirmed, the potential exists given the nature of the targeted devices. The threat affects utilities of all sizes, including those with mature cybersecurity programs, indicating a broad impact on critical infrastructure availability and reliability.

Defensive guidance

CISA strongly recommends removing all internet-exposed PLCs and other operational technology from direct internet access immediately. If removal is not feasible, secure access should be enforced using VPNs or gateway devices. Default passwords must be changed, and access should be restricted to a defined IP address allow-list. Operators of Rockwell Automation MicroLogix 1400 PLCs should consult vendor guidance for recovering access if passwords have been altered. Organizations should also identify and address undocumented cellular modems that may expose OT devices. There is no indication of an official patch; mitigation focuses on reducing exposure and securing remote access as the primary defense.

References

bleepingcomputer.com/news/security/cisa-warns-of-cyberattacks-disrupting-us-water-utilities/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 31 Jul 2026, 19:19 UTC

References

Community reviews