The Cybersecurity and Infrastructure Security Agency (CISA) on July 30 warned water and wastewater utilities that it is seeing a “significant increase” in cyber threat activity targeting internet-exposed programmable logic controllers (PLCs). The agency urged operators to remove those devices from direct internet access immediately.
According to a July 30 CISA alert, threat actors have altered PLC passwords to lock operators out of systems and changed device IP addresses to disconnect controllers from networks. The agency said those attacks have already led to boil water notices and forced some utilities to rely on sustained manual operations.
“These threat actors are targeting water entities of all sizes,” CISA said. “Even water organizations with mature cybersecurity processes should validate their external connections, as this targeting activity includes cellular modems installed by operators, vendors, or system integrators that may not be documented or included in routine attack surface scans.”
The agency said internet-exposed operational technology (OT) assets face a greater risk of unauthorized configuration changes, service disruptions, equipment defacement, and physical damage.
To reduce those risks, CISA recommended that organizations disconnect PLCs from the public internet and instead route remote access through a virtual private network (VPN) or secure gateway.
The agency also advised utilities to enable password protection, replace default credentials, restrict remote access to approved IP addresses, and maintain verified backups of PLC images in case operators are locked out of devices.
For organizations using Rockwell Automation MicroLogix 1400 PLCs, CISA directed operators to the vendor’s guidance on restoring controller access after passwords have been changed.
“What concerns me most is that these events are becoming less surprising,” Gary Barlet, public sector chief technology officer at Illumio, told MeriTalk.
“During periods of geopolitical tension, critical infrastructure operators should expect increased probing, scanning, and attempted intrusions,” Barlet added. “The question is no longer whether organizations might become targets, but whether they’re prepared when they do.”
Felipe Fernandez, chief technology officer at Fortinet Federal, added, “CISA’s warning shows how quickly cyber risk can become operational and public-health risk when PLCs are directly accessible from the internet.”
“Water and wastewater operators should remove direct exposure, secure remote access, segment critical systems, monitor OT activity, and maintain tested recovery procedures,” Fernandez said.
The CISA alert comes as federal agencies respond to a broader wave of cyber activity targeting U.S. water systems. In a joint public service announcement released Thursday, the FBI and Environmental Protection Agency said water and wastewater utilities in at least seven states have reported cyber incidents since July 27 involving internet-facing OT devices, including PLCs.
CISA’s warning also follows this week’s cyberattacks against more than 30 municipal water systems in Minnesota. Federal and state investigators are examining the incidents, and while media reports have cited officials who believe Iranian hackers are the likely perpetrators, the FBI and Minnesota have not publicly attributed the attacks or confirmed a responsible actor.
State officials said the attacks caused operational disruptions at some utilities but did not affect drinking water safety.
“Minnesota shows what [gaps] looks like in practice. The attacks do not appear to have required sophisticated techniques; exposed controllers and default credentials may have been enough,” Bill Wright, head of government affairs at Everpure, said in a statement to MeriTalk.
“Basic cyber hygiene could have gone a long way, but utilities must also ensure that the operational data supporting this sector remains accurate, available, and recoverable,” Wright added.
Adam Ford, chief technology officer for state and local government and education at Zscaler and former CISO for the state of Illinois, said, “Smaller water utilities are being asked to defend against nation-state attackers with limited staff and aging infrastructure. Zero trust meets them where they are: take OT off the public internet, verify every connection, and shrink the attack surface with the resources you have today.”