This threat involves a widespread cyberattack campaign targeting water sector infrastructure in the United States, affecting at least 12 states. Attackers have exploited internet-exposed Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 series PLCs to remotely alter device configurations, including changing IP addresses and setting passwords, resulting in loss of visibility and control over connected equipment. Operational impacts reported include reduced water pressure and flooding, with potential risks such as untreated groundwater infiltration due to pressure loss. The FBI confirmed the attacks and linked them to malicious cyber actors targeting ICS devices. The campaign appears aligned with previous Iranian state-sponsored activities against OT environments. Federal agencies have issued advisories emphasizing the need to secure PLCs from internet exposure and to apply recommended mitigations. No significant disruptions to water safety have been reported, and some affected systems restored service within hours.

The attacks have caused temporary operational disruptions in water systems, including reduced water pressure and flooding. These disruptions could potentially allow untreated groundwater to enter water pipes, posing a contamination risk. However, no confirmed incidents of water safety compromise have been reported. The loss of control and visibility over PLCs impairs monitoring and management of critical water infrastructure. The campaign affects multiple states and numerous community water systems, indicating a broad threat to water sector operational technology. The FBI and federal agencies have confirmed the targeting of specific PLC models and highlighted the risk of similar attacks spreading due to common network configurations across victims.

Federal agencies including the FBI and CISA have issued advisories recommending that water sector organizations secure their operational technology systems, particularly internet-exposed Rockwell Automation MicroLogix 1100 and 1400 series PLCs. Organizations should restrict internet exposure of PLCs, apply network segmentation, change default credentials, and monitor for unauthorized configuration changes. The vendor Rockwell Automation has released patches for some related vulnerabilities, and affected entities should apply these updates where applicable. The water sector is urged to follow updated guidance on securing ICS devices from Siemens, Schneider Electric, and Rockwell Automation. No reports indicate that the threat is already mitigated; therefore, proactive security measures remain critical. Patch status for specific PLC vulnerabilities should be confirmed via vendor advisories. The FBI and WaterISAC provide ongoing information sharing to support defense efforts.