In late July 2026, a cyber campaign targeting water and wastewater OT systems impacted at least seven U.S. states, with Minnesota reporting attacks on over 30 facilities. Michigan, South Dakota, and Georgia also confirmed incidents linked to Iran-affiliated threat actors. The attacks focused on OT equipment connected through cellular networks, a known intrusion vector. Federal advisories prior to the attacks warned of Iranian targeting of ICS devices from Siemens, Schneider Electric, and Rockwell Automation, with thousands of such PLCs exposed online. Despite the attacks, affected systems reportedly continued safe operation with no public health impact. WaterISAC and Minnesota Fusion Center reports aligned the attacks with previous Iran-linked campaigns. CISA urged enhanced protection of programmable logic controllers (PLCs) in the water sector following these events.

The cyberattacks targeted OT systems in the water and wastewater sector across multiple U.S. states, potentially risking operational disruption. However, no confirmed operational impacts or public health threats have been reported. The attacks demonstrate the ability of threat actors to access critical infrastructure OT endpoints, particularly those connected via cellular networks. The exposure of thousands of ICS devices online increases the risk of future exploitation. The campaign underscores the ongoing threat posed by nation-state actors to critical infrastructure sectors.

No official patch or fix is applicable as this is a campaign targeting OT systems rather than a specific software vulnerability. Federal agencies including CISA have issued advisories recommending enhanced protection of programmable logic controllers (PLCs) and OT devices, especially those connected via cellular networks. Organizations in the water sector should follow these advisories and implement recommended security controls for ICS/OT environments. Continuous monitoring and segmentation of OT networks, along with restricting internet exposure of PLCs, are prudent measures. Check vendor advisories and CISA alerts for updated guidance.