Water utility PLC attacks: the control layer that was never designed to authenticate

In July 2026, the Cybersecurity and Infrastructure Security Agency (CISA) reported malicious activity targeting over 100 internet-exposed systems in the water and wastewater sector. These attacks primarily affected programmable logic controllers (PLCs) connected via cellular modems. At least twelve US states reported incidents, with several utilities confirming the breaches.

The methods used by the attackers were straightforward, involving scanning for exposed controllers, logging in with default or weak credentials, altering the administrator password, modifying device IP addresses, and locking operators out. These actions were consistent across reported incidents and resulted in a loss of remote visibility for operators.

They could no longer monitor pump status, valve positions, or pressure readings through the normal system. Some utilities reverted to manual methods for readings and operated hand-operated valves.

The exposure of PLCs is a result of their design, prioritizing availability and physical durability over hostile network security. Older models, still in widespread use, lack native encryption, certificate validation, and multi-factor authentication. Protocols like Modbus and EtherNet/IP were designed for trusted local networks and do not provide authentication of their own.

Remote monitoring, a useful feature, was achieved by attaching cellular modems to PLCs and accessing them over the internet. However, this convenience leads to undocumented connections, making them invisible to perimeter controls and posing a significant security risk. CISA referred to this as a "cellular modem blind spot," where connection paths are not documented and therefore not monitored.

Public data suggests thousands of industrial protocol hosts are reachable from the internet, with a substantial number in the United States. These figures represent exposed services, not necessarily confirmed vulnerable or compromised devices. It's important to note that merely having a controller respond on specific ports does not guarantee it accepts default credentials, a separate issue that measurement does not address.

The primary defense against these attacks involves removing direct internet exposure. If remote access is necessary, it should be routed through a VPN or an industrial gateway with authentication, rather than being directly mapped from a cellular modem to the controller. Default or weak passwords should be replaced across all devices, including those considered internal.

Network segmentation limits the reach of a single compromised controller, while backups become even more critical in this context. A clean offline copy of controller logic and configuration allows for recovery when attackers change passwords and programs. Without backups, restoring a locked controller may necessitate a site visit.

Additionally, it's crucial to inventory undocumented connections. In many cases, cellular modems were installed for convenience and never recorded in an asset register. An inventory that overlooks such connections cannot protect them effectively. The July 2026 campaign's attribution was not officially established by US authorities at the time of reporting.

Some security vendors drew comparisons to earlier activity against industrial control systems, and press reporting speculated about state-linked actors. However, official statements only described the actors as malicious cyber actors. The reported figure of over 100 affected systems is an external observation, not a confirmed count of successful intrusions. The article does not claim to attribute the attack.