Hackers broke into the digital controls of U.S. drinking water plants again this year, and this time the federal government is naming the failure point out loud: exposed programmable logic controllers, or PLCs, sitting on the open internet with no password and no firewall between them and anyone who wants in. The FBI and the Environmental Protection Agency issued a joint Public Service Announcement warning that malicious cyber actors are actively targeting Rockwell Automation and Allen-Bradley MicroLogix 1100 and 1400 series controllers, the small industrial computers that open valves, run pumps, and dose chemicals at treatment plants. Since July 27, 2026, water and wastewater utilities in at least seven states have reported incidents to the FBI, and some of that activity degraded actual water operations, not just IT systems sitting behind an office firewall.
The pattern is not new, but the scale is, and it fits a broader run of cybersecurity incidents hitting critical infrastructure this year. CISA said in a July 30 notice that PLCs are frequently connected directly to the internet, often through a cellular modem installed by an operator or a vendor and then forgotten, which lets attackers reach the equipment’s control functions directly. CBS News reported that cybersecurity researchers examining the exposed devices found many with no password at all, or with a default password nobody bothered to change. That is the entire story in one sentence: decades-old industrial hardware, built for isolated factory floors, is now sitting on the public internet with the digital equivalent of an unlocked front door.
What CISA and the FBI Actually Confirmed
CISA’s alert, published July 30, 2026, states the agency is “currently observing a significant increase in cyber threat actors targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems (WWS) Sector,” according to the agency’s published alert. The advisory goes further than most prior warnings by describing the actual mechanics of the intrusions: threat actors have modified operator passwords to lock legitimate staff out of their own equipment, and in some cases disconnected PLCs entirely by changing their IP addresses, according to CISA. That is not vandalism for its own sake. Locking an operator out of a chemical-dosing controller or a pressure-regulation valve is the kind of move that turns a cybersecurity incident into a public-health event within hours.
Separately, reporting cited by NBC Chicago describes CISA observing malicious activity in July 2026 against “over 100 internet-exposed systems in the Water and Wastewater Systems (WWS) Sector, commonly via programmable logic controllers (PLCs) connected directly to a cellular modem.” That figure, over 100 exposed systems touched in a single month, gives the first real sense of scale behind a story that started as scattered local incidents and is now being treated as a sector-wide exposure problem. The FBI-EPA joint PSA frames this as an active, ongoing campaign rather than a single breach, which changes how utilities, regulators, and vendors need to respond.
Why Water Utilities Keep Losing This Fight
Water utilities are an unusually hard sector to secure, and it is not because operators are careless. Most U.S. water systems are small. Thousands of them serve a few thousand customers with a handful of IT staff, sometimes none at all, and the operational technology running the plant was often installed ten or twenty years before anyone worried about it having an IP address. PLCs like the MicroLogix 1100 and 1400 were designed as reliable, simple industrial controllers, not as internet-facing devices with modern authentication. When a vendor or a contractor adds a cellular modem for remote diagnostics and support, the PLC effectively gets a public IP address, and if nobody circles back to lock that connection down with a VPN or a firewall rule, the controller is reachable from anywhere on Earth.
CNN’s reporting on the campaign made the point bluntly: the hackers are targeting internet-facing PLCs, the devices that let machinery communicate at water facilities and other industrial plants, according to CNN. CNN’s sourcing also describes the intrusions themselves as unsophisticated, noting attackers are breaking into PLCs that are simply sitting online and vulnerable rather than exploiting some novel zero-day. That is arguably the most uncomfortable part of the story for the sector: this is not an elite, well-funded adversary using custom malware. It is opportunistic scanning for devices that were never supposed to be reachable in the first place, and finding thousands of them.
The Dragos Assessment: No Passwords, No Firewalls
Industrial cybersecurity firm Dragos has been tracking operational technology intrusions in the water sector for years, and its read on the current wave lines up with what CISA and the FBI are describing. Lesley Carhart, director of industrial control systems security at Dragos, told CBS News: “These systems were directly on the internet with no firewalls or VPNs or anything, with no passwords set in most cases.” That single sentence captures the gap between the sophistication people assume attackers need and the reality of what these breaches actually require. There is no advanced persistent threat tradecraft involved in typing a default password into a login prompt that should never have been reachable.
Carhart’s framing matters because Dragos sits closer to the actual incident response calls than most outside commentators. The firm has spent years building out OT-specific threat intelligence precisely because water, energy, and manufacturing environments run on hardware that traditional enterprise security tools were never designed to monitor. When a controls engineer at a small utility gets locked out of a chemical feed pump because someone on another continent changed the login credentials, that is squarely a Dragos-category incident, and the firm’s public statements this year reflect a sector that has been warned repeatedly and is still catching up.
Historical Context: This Has Happened Before
The water sector’s PLC problem is not a 2026 invention. In November 2023, Iranian-linked hackers operating under the banner “CyberAv3ngers” broke into a Unitronics PLC at the Municipal Water Authority of Aliquippa, Pennsylvania, defacing the controller’s interface with a political message and forcing the utility to switch to manual operation. CISA’s advisory at the time stated that “cyber threat actors are targeting PLCs associated with WWS facilities, including an identified Unitronics PLC, at a U.S. water facility,” a warning documented in reporting from The Hacker News. That single incident triggered a wave of federal guidance, vendor patches, and sector alerts, yet three years later the underlying exposure problem, internet-facing PLCs with weak or absent authentication, is still widespread enough to produce a fresh multi-state campaign.
What changed between 2023 and 2026 is scale and persistence, not technique. The Aliquippa breach was one utility, one PLC brand, one identifiable threat actor with a geopolitical motive. The current campaign spans at least seven states, multiple PLC models from Rockwell Automation, and, according to the FBI-EPA PSA, attackers whose specific attribution has not been publicly confirmed. The mechanics are nearly identical: find an exposed controller, log in with a default or missing password, and take an action that disrupts operations. The fact that the same playbook works three years later is the clearest evidence that remediation across the sector has been partial at best.
Timeline of the 2026 Water Sector Campaign
| Date | Event | Source |
|---|---|---|
| July 27, 2026 | Water and wastewater utilities in at least seven states begin reporting incidents to the FBI | FBI-EPA joint PSA |
| July 30, 2026 | CISA publishes alert urging the WWS sector to protect OT from PLC-targeting activity | CISA |
| July 2026 (reported) | CISA observes malicious activity against over 100 internet-exposed WWS systems, commonly via cellular-modem-connected PLCs | NBC Chicago |
| Late July 2026 | CBS News and CNN publish reporting describing attackers exploiting PLCs with no passwords or network protections | CBS News, CNN |
| November 2023 (prior incident) | CyberAv3ngers deface a Unitronics PLC at the Aliquippa, PA water authority, the precedent case for this threat pattern | CISA, The Hacker News |
What Actually Gets Exposed: PLC Function and Risk
To understand why this matters beyond IT jargon, it helps to know what a PLC actually does. CBS News described PLCs as the components that turn industrial equipment on and off, controlling factors like water pressure or the chemicals added during treatment. They are not general-purpose computers. They run a narrow, dedicated program: open this valve at this pressure, add this much chlorine, run this pump on this schedule. That narrowness is normally a security advantage, since there is less attack surface than a full operating system, though the same root cause, a basic access misconfiguration, keeps showing up across unrelated breach categories. But it becomes a liability once the device is internet-reachable, because a PLC has no concept of “suspicious login” the way a modern web application might. If the credentials are correct, or if there are no credentials at all, the device does exactly what it’s told, whether that instruction comes from a licensed operator or an anonymous attacker three time zones away.
| Exposure Factor | Why It Matters | Typical Fix |
|---|---|---|
| Direct internet connection via cellular modem | Gives the PLC a public IP address reachable from anywhere | Route remote access through a VPN or engineering gateway |
| Default or missing password | Any scanner that finds the device can log in without effort | Enforce unique, non-default credentials on every controller |
| No firewall or network segmentation | Lets an attacker reach the OT network directly from the internet | Segment OT from IT and the public internet with firewall rules |
| No IP allowlisting | Any source address can attempt a connection to the controller | Restrict access to known engineering-workstation IP addresses |
| No backup of the PLC’s logic/configuration | Recovery after tampering requires manual reprogramming | Maintain and periodically test clean configuration backups |
The Federal Response: A PSA, Not (Yet) a Mandate
It is worth being precise about what the FBI and EPA actually did here, because a Public Service Announcement is a warning, not a binding regulation. The PSA tells utilities what is happening and recommends steps to take, but it does not carry the enforcement weight of an EPA rule or a CISA binding operational directive of the kind that applies to federal civilian agencies. Water utilities are largely municipal or regionally owned, which means Washington can strongly encourage better OT hygiene but cannot simply order 50,000 separate water systems to disconnect their PLCs from cellular modems by a hard deadline. That structural gap, a fragmented, locally governed sector facing a nationally coordinated threat, is part of why the same exposure keeps recurring.
CISA’s recommended fixes in the July 30 alert are not exotic. They amount to disconnecting PLCs from the open internet, requiring a VPN or dedicated gateway for any remote access, changing default passwords, allowlisting only known engineering IP addresses, and keeping clean backups of PLC configurations so a compromised controller can be restored quickly. None of that requires new hardware purchases at most sites. What it requires is staff time, and staff time is exactly what small water utilities are shortest on.
Market and Vendor Impact
The immediate market effect of a campaign like this lands on industrial cybersecurity vendors and OT-focused consultancies rather than on broad tech indices, echoing how 100-plus companies warned of a similar spike in attack volume earlier this year. Firms such as Dragos, which specialize in monitoring and defending operational technology environments, tend to see renewed utility interest and contract inquiries whenever a sector-wide warning like this becomes national news. Rockwell Automation, whose Allen-Bradley MicroLogix controllers are specifically named in the FBI-EPA PSA, faces the familiar dynamic that hits any hardware vendor named in a federal advisory: pressure to publish clearer default-configuration guidance, and scrutiny over how many end-of-life or long-deployed units in the field were never designed with today’s threat model in mind.
There is also a slower-moving effect on insurance and municipal budgeting. Water utilities that get named in a breach report, even one where “operational impacts were limited,” as some officials have characterized incidents in this campaign, tend to face harder questions from cyber insurers and from city councils approving next year’s capital budget. Expect line items for OT network segmentation and PLC remote-access hardening to show up in more municipal water utility budgets heading into 2027, driven less by a single mandate than by the cumulative weight of incidents like this one making local news.
Competitive Landscape: How Other Critical Infrastructure Sectors Compare
Water is far from the only critical infrastructure sector wrestling with exposed operational technology, but it is arguably the sector with the least resourcing per facility. Electric utilities, for comparison, have spent over a decade under mandatory NERC CIP cybersecurity standards with real enforcement teeth, including financial penalties for noncompliance. Water utilities have no equivalent binding federal cybersecurity standard. EPA’s authority in this space has been contested and narrowed by courts in recent years, leaving a patchwork of voluntary guidance instead of enforceable requirements. That regulatory gap is a large part of why PLC exposure in water keeps resurfacing as a story while, for instance, large-scale unauthenticated PLC exposure at bulk power system utilities is comparatively rare.
Manufacturing and energy OT environments also run PLCs, often from the same vendors, including Rockwell Automation and Siemens, but those sectors typically have larger IT security budgets and more mature network segmentation between the corporate network, the OT network, and the internet. The pattern holds across nearly every OT-heavy sector, the smaller and less funded the operator, the more likely a controller ends up reachable from the public internet, and water utilities skew smaller and less funded than almost any other category of critical infrastructure operator in the country.
What Utilities Should Do Right Now
The recommendations coming out of CISA’s alert are specific enough to act on immediately, and none of them require an enterprise security budget. First, every PLC connected via cellular modem or any other internet-facing link needs to move behind a VPN or dedicated engineering gateway, full stop. Second, every default password needs to be changed, and every controller needs a unique credential, not one shared password across the whole plant. Third, network administrators should build an allowlist limiting inbound connections to known engineering workstation IP addresses rather than leaving the door open to the entire internet.
Fourth, and often skipped, utilities need a current, tested backup of every PLC’s configuration and logic program. If a controller is compromised and its program altered, the fastest recovery path is restoring from a known-good backup rather than reprogramming from scratch under pressure while a boil-water notice is already in effect. Fifth, utilities without in-house OT security expertise should reach out to EPA’s Cybersecurity Technical Assistance Program for the Water Sector, which exists specifically to help under-resourced systems close exactly this kind of gap. None of these five steps is glamorous. All five are what separates a utility that shrugs off an internet scan from one that ends up in a national news story.
Code-Level Example: What an Exposed PLC Interaction Looks Like
For readers with a technical background, it helps to see why this is trivial to automate for an attacker. A basic port scan combined with a known default-credential list is often all it takes to identify and log into an unprotected industrial controller. The illustrative pseudocode below shows the shape of the problem, a scanner checking a range of addresses for an open PLC management port and a matching default login, not actual working exploit code.
# Illustrative only -- shows why exposure, not sophistication, is the risk
for ip in target_range:
if port_open(ip, PLC_MANAGEMENT_PORT):
if try_login(ip, username="admin", password="admin"):
log_finding(ip, status="unauthenticated_access_possible")
That is the entire technical bar for the “unsophisticated” attacks CNN described. Removing the PLC from the open internet, or at minimum putting a real password on it, defeats this class of scan completely. The fix is boring. That is exactly why it keeps not happening at every site.
Predictions: Where This Story Goes Next
First, expect the number of states reporting incidents to grow beyond seven in the coming weeks as smaller utilities that have not yet noticed tampering discover it during routine maintenance checks. Second, expect renewed congressional pressure for a binding federal cybersecurity standard for the water sector, similar in spirit to NERC CIP for electric utilities, though passage within 2026 is unlikely given how slowly water-sector legislation has historically moved. Third, expect Rockwell Automation and other PLC vendors to push firmware updates or configuration tools that make it harder to deploy a controller with default credentials still active, a fix that addresses the symptom more easily than the root cause of remote cellular access.
Fourth, expect OT-focused cybersecurity vendors, Dragos among them, to report increased utility client engagement in their next earnings or public commentary, since incidents like this reliably drive procurement conversations even at cash-strapped municipal agencies. Fifth, and most likely, expect this exact story to repeat again within twelve to eighteen months at a different set of utilities, because the underlying economics, small operators, thin IT staffing, aging OT hardware, and a voluntary rather than mandatory federal standard, have not changed since the 2023 Aliquippa incident and show no sign of changing before the next PSA goes out.
Frequently Asked Questions
What is a PLC and why does it matter for water safety?
A programmable logic controller, or PLC, is a small industrial computer that automates physical processes like opening valves, running pumps, and dosing chemicals at a water treatment plant. If an attacker gains control of a PLC, they can potentially alter water pressure or chemical treatment levels, which is why federal agencies treat PLC exposure as a public-safety issue, not just an IT problem.
How many U.S. states have reported water system cyberattacks in this 2026 wave?
According to the FBI-EPA joint Public Service Announcement, utilities in at least seven states reported incidents to the FBI beginning July 27, 2026, with some incidents degrading actual water operations.
Which PLC models are specifically named in the federal warning?
The FBI-EPA PSA specifically names Rockwell Automation and Allen-Bradley MicroLogix 1100 and 1400 series programmable logic controllers as targets of the current campaign.
Is this the same as the 2023 Aliquippa, Pennsylvania water hack?
No, it is a separate and larger 2026 campaign, but it follows the same pattern as the November 2023 incident in Aliquippa, where Iran-linked hackers defaced an exposed Unitronics PLC. Both cases involve internet-facing PLCs with weak or missing authentication.
Did any of the 2026 attacks actually disrupt drinking water service?
The FBI-EPA PSA states that some of the reported activity degraded water operations. Officials cited in reporting on the campaign have said the sector’s inherent resilience helped limit broader operational impacts, though specific outage details for individual utilities have not been fully disclosed publicly.
What should a small water utility do first if it doesn’t have dedicated IT security staff?
CISA recommends disconnecting PLCs from direct internet access, requiring a VPN for any remote connection, and changing default passwords immediately. Utilities without in-house expertise can also contact EPA’s Cybersecurity Technical Assistance Program for the Water Sector for direct support.
Is there a federal law requiring water utilities to meet cybersecurity standards?
Unlike the electric grid, which operates under mandatory NERC CIP cybersecurity standards, the U.S. water sector does not currently have an equivalent binding federal cybersecurity mandate, leaving compliance largely voluntary and guidance-driven.
Who is believed to be behind the 2026 water sector attacks?
Public attribution has not been confirmed in the sources reviewed for this article. The FBI-EPA PSA refers generally to “malicious cyber actors” without naming a specific group or nation, which distinguishes this campaign from the 2023 Aliquippa incident, where CyberAv3ngers, a group linked to Iran, was publicly identified.
