The U.S. government has confirmed that over 100 internet-exposed water systems were targeted by malicious cyber activity in July. This marks the first time federal authorities have provided a specific number for these intrusions, though they have not publicly attributed the campaign to any specific group.
The Cybersecurity and Infrastructure Security Agency (CISA) observed that the attacks primarily leveraged programmable logic controllers (PLCs) directly connected to cellular modems. CISA emphasized that such direct internet exposure of PLCs creates significant security risks.
While federal and state officials have not disclosed all affected locations, the attacks reportedly impacted mostly small, rural utilities across at least a dozen states, including Minnesota, Michigan, Georgia, South Dakota, and New Jersey.
Security experts note the significant scale of the attacks, suggesting a systemic vulnerability within the water sector rather than isolated incidents. Operational technology, such as PLCs, was historically designed for closed, physical environments and not for direct exposure to the open internet.
Although the 100-plus incidents occurred in July, five U.S. federal agencies recently issued a warning about attackers using AI-generated exploitation scripts to breach internet-exposed Siemens S7 Series PLCs in various critical infrastructure sectors, including water, manufacturing, and energy. This activity is suspected to be a continuation of the same campaign.
Analysts largely suspect Iran-affiliated actors are behind these intrusions, noting their active targeting of operational technology that underpins essential health, safety, and critical infrastructure. However, the federal government has refrained from public attribution, citing the inherent difficulty and time required for such investigations.
CISA's immediate priority has been to provide actionable information to water-sector operators to help them defend their systems. The agency recommends disconnecting PLCs from the internet and ensuring that any remote access is routed through a VPN or gateway device, rather than directly connecting to the PLC.
Additionally, CISA advises implementing password protection, ideally with multi-factor authentication, and changing any default passwords. Organizations should also configure IP allowlists to restrict remote access to only known engineering laptops or other critical operational technology assets.
