CISA has observed a surge in cyberattacks targeting internet-facing programmable logic controllers (PLCs) within the U.S. water and wastewater systems sector. Attackers have disrupted operations by changing PLC passwords, modifying IP addresses, and locking out operators, affecting over 30 community water systems in Minnesota. The advisory emphasizes that internet-exposed operational technology, including undocumented cellular modems, is vulnerable to defacement, configuration changes, operational disruption, and potential physical damage. CISA recommends removing PLCs from direct internet exposure or securing access through VPNs or gateway devices, changing default passwords, and restricting access via IP allow-lists. The alert specifically references Rockwell Automation MicroLogix 1400 PLCs, many running end-of-sale firmware, and points to vendor guidance for recovery. Internet exposure estimates show thousands of PLCs from major vendors reachable online, underscoring the widespread risk. The Minnesota IT Services agency activated its incident response plan following these coordinated attacks. No official patch or fix is indicated; mitigation focuses on reducing exposure and securing access.

The attacks have caused operational disruptions at multiple water utilities, forcing some to switch to manual operations temporarily. The compromise of PLCs can lead to loss of control over water system processes, potentially affecting water treatment and distribution. The exposure of PLCs to the internet increases the risk of unauthorized access, configuration changes, and operational downtime. While no physical damage has been confirmed, the potential exists given the nature of the targeted devices. The threat affects utilities of all sizes, including those with mature cybersecurity programs, indicating a broad impact on critical infrastructure availability and reliability.

CISA strongly recommends removing all internet-exposed PLCs and other operational technology from direct internet access immediately. If removal is not feasible, secure access should be enforced using VPNs or gateway devices. Default passwords must be changed, and access should be restricted to a defined IP address allow-list. Operators of Rockwell Automation MicroLogix 1400 PLCs should consult vendor guidance for recovering access if passwords have been altered. Organizations should also identify and address undocumented cellular modems that may expose OT devices. There is no indication of an official patch; mitigation focuses on reducing exposure and securing remote access as the primary defense.