The Cybersecurity and Infrastructure Security Agency (CISA) has issued a public alert regarding a significant increase in malicious activity targeting water utilities, advising facilities to promptly remove publicly exposed Programmable Logic Controllers (PLCs) and other operational technology (OT) from the internet. This warning comes as state and federal investigators probe whether recent disruptions to Minnesota water systems are linked to Iran-backed hackers.
CISA's alert, published on Thursday, details that threat actors are targeting water entities of all sizes, modifying passwords to lock out operators and disconnecting PLCs by altering their IP addresses. This activity has led to boil water notices and necessitated sustained manual operations at affected facilities. The agency, in conjunction with the FBI and the Environmental Protection Agency (EPA), is involved in the ongoing response.
Earlier this week, Minnesota's state IT agency confirmed that over 30 community water systems in the state were impacted by a coordinated cyberattack beginning on July 26. While CISA's latest alert does not explicitly name Iran, multiple reports, including a memo from the WaterISAC (the water industry's cybersecurity information-sharing body), have suggested a connection to Iran-linked actors for the Minnesota incidents.
The FBI has reported that utility companies in at least seven states have informed the bureau of incidents involving PLCs. CISA had previously updated warnings earlier this month about Iranian-linked malicious activity targeting industrial OT.
The agency emphasized that even water organizations with mature cybersecurity processes should validate their external connections. This is particularly crucial because the targeting activity includes cellular modems installed by operators, vendors, or system integrators, which may not be documented or included in routine attack surface scans.
CISA underscored the risks associated with internet-exposed OT assets, which include defacement, configuration changes, operational disruptions, and, in severe cases, physical damage. PLCs are fundamental components in the control processes of various industries.
