The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding a significant increase in cyberattacks targeting internet-exposed programmable logic controllers (PLCs) within the water and wastewater systems sector. This warning follows a series of disruptions affecting over 30 community water systems in Minnesota, with attacks commencing last Sunday and continuing into Monday.
CISA's bulletin details that threat actors are exploiting exposed PLCs to change passwords, locking out operators, and modifying IP addresses to disconnect devices from the internet, among other actions that disrupt operations. The agency emphasizes that organizations of all sizes, including those with mature cybersecurity programs, are being targeted.
A key concern highlighted by CISA is the presence of undocumented cellular modems, often installed by operators, vendors, or system integrators, which expose operational technology (OT) to the public internet. Such exposure can lead to defacement, configuration changes, operational disruptions, and even physical damage.
CISA strongly recommends the immediate removal of these internet-facing assets. Where direct removal is not feasible, organizations should implement secure access methods such as VPN connections or gateway devices. Additionally, the agency advises changing all default passwords and restricting access to an IP address allow-list. For owners of Rockwell Automation MicroLogix 1400 PLCs, CISA points to vendor guidance for recovering access if passwords have been altered.
Cybersecurity search firm Censys has quantified this exposure, identifying over 4,100 internet-exposed Rockwell Automation/Allen-Bradley hosts, 4,100 Siemens hosts, and more than 2,000 Schneider Electric hosts. Censys clarifies that while these devices are reachable over the public internet, this does not necessarily mean they are actively targeted or compromised. Many of the MicroLogix 1400 controllers mentioned by CISA appear to be running end-of-sale (EoS) firmware versions.
Censys also corroborated the issue of undocumented cellular modems, noting that nearly half of the exposed Rockwell devices are accessible via major cellular and internet service provider networks, including Verizon Business, AT&T, T-Mobile, Comcast, Charter, and Starlink. The firm has provided an expanded set of indicators of compromise (IoCs) and threat-hunting guidance in its report.
Earlier this week, Minnesota IT Services (MNIT) activated the state's cybersecurity incident response plan in response to what it described as a "coordinated cyberattack targeting operational technology at more than 30 Minnesota community water systems." Multiple municipalities reported equipment malfunctions caused by the attacks, forcing some utilities to temporarily switch to manual operations. MNIT has shared threat intelligence from affected systems and offered guidance to help utilities restore normal operations.
