Water System Cyberattacks:What Operators Should Check Now
Federal and state agencies reported cyber activity affecting water-utility operational technology in late July 2026. The FBI and EPA said actors remotely accessed internet-facing Rockwell MicroLogix 1100 and 1400 PLCs, changed IP addresses and passwords, and disrupted monitoring or control. Reported effects included pressure loss and flooding. FBI/EPA PSA I-073026-PSA.
Go to the self-assessment ↓What's confirmed?
The FBI and EPA reported that malicious actors remotely accessed internet-facing Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 PLCs. The actors changed device IP addresses and set passwords, causing losses of monitoring or control. At least one organization reported modified PLC project files after finding ladder-logic discrepancies across several sites. FBI alert.
The FBI/EPA notice documents operational impacts. It describes loss of monitoring or control, changed device settings, modified PLC project files, pressure loss and flooding.
Minnesota IT Services said a coordinated cyberattack targeted operational technology at more than 30 community water systems on July 26 and 27, 2026. The investigation remained active when the state published its notice. Read the state notice.
The FBI said some activity degraded water operations. Reported effects included loss of pressure and flooding. Read the federal alert.
CBS News reported on August 1 that investigators were examining a possible foreign link and had not reached a definitive attribution at that time. Read the reporting.
What could an incident do to a utility?
The FBI said the operational impact depended on what the PLC monitored or controlled, the equipment and function involved, and whether the utility could switch to manual operations. The PSA also recommends validating running logic and checking backups before restoration. FBI/EPA PSA.
You lose visibility
Operators may lose the normal view of connected equipment and the information used to monitor operations.
You lose remote control
Connected equipment may stop responding through normal controls, which may require the utility to switch to manual operation.
Operators get locked out
Changed passwords or IP addresses can prevent authorized staff from reaching equipment through the normal connection.
Pressure loss creates a public-health concern
The FBI said pressure loss could allow untreated groundwater to enter pipes, making pressure events both an operational and public-health concern.
Recovery requires known-good files
The FBI and EPA recommend comparing the running program with known-good logic and checking backups for unauthorized changes before restoration.
The response can require manual operations
Public reports show utilities switching to manual operation while local, state and federal teams handled containment, investigation and recovery.
The first sign may look operational. In Braham, staff noticed a malfunctioning well. In Plymouth, interrupted device communications triggered the response. CBS News.
How can a PLC be affected if it isn't directly internet-facing?
The FBI/EPA notice documents direct internet exposure and tells utilities to review connected modems, HMIs and workstations for possible lateral movement. A field PLC can also sit behind upstream systems that provide monitoring, control or remote maintenance. The actual path depends on the utility's architecture. FBI/EPA PSA.
This is an illustrative architecture created by CrunchAtlas. It isn't an agency diagram, a reconstruction of the July 2026 incidents or the only way a control environment may be reached. Utilities use different designs, and an incident may involve a different path or only part of this chain. Trace the actual communication paths in your environment.
Does a private radio network make remote sites secure?
A private radio link may reduce direct public-internet exposure. It doesn't establish that the broader control path is isolated: the headend, central controller, gateways and remote-maintenance paths still need to be mapped and secured. Federal OT asset-inventory guidance recommends documenting assets, connections, ownership and communication details across the environment. OT asset inventory guidance.
What radio can improve
- Can keep field devices from being directly exposed to the public internet.
- Can limit which systems communicate with field equipment.
- Can separate control traffic from ordinary Wi-Fi and business networks.
- Can reduce direct exposure to internet scanning and attacks against the field device.
What still needs to be checked
- Is the link monitoring-only, or can it carry commands?
- Which central system sends information across the radio?
- What other networks can reach that central system?
- Is there vendor access, cellular backup or remote management?
- Would an unexpected command or change be recorded and noticed?
Ask: What system sends instructions across the radio network, and what people, devices or networks can connect to that system?
What does air-gapped actually mean?
In this guide, air-gapped means the control environment has no direct or indirect network connection to an outside network. Remote access, modems, dual-connected computers and other network bridges mean it isn't air-gapped.
Ask: Have we traced every permanent, temporary and backup path that can carry data or commands into the control environment?
The connections below may be legitimate and well protected, but they still create a route or transfer mechanism that must be included in the security review. Maintenance laptops and removable media can also carry risk even when no permanent network connection exists.
Water Utility PLC and SCADA Security Questions, Answered
These answers apply the July 30, 2026 FBI/EPA guidance, CISA's water-sector alert, EPA/CISA HMI guidance and federal OT asset-inventory guidance to common utility questions.
Not automatically. Direct exposure is a major risk, but a PLC may still be reachable through an HMI, engineering workstation, gateway, modem, vendor connection or other trusted system upstream.
It can reduce direct exposure. The utility still needs to secure the radio headend, the system sending commands, any remote-management path and every network that can reach those systems.
No single control is enough. The important questions are which traffic is allowed, which devices are trusted, whether rules are limited to operational need and whether access is logged and reviewed.
Only if the scope and responsibilities say so. The utility should document who owns passwords, remote access, firewall rules, backups, logging, PLC changes, incident response and notification duties.
No. If the HMI, communications path or monitoring system is affected, the alarm may be missing, delayed or untrustworthy. Operators need another way to confirm field conditions.
Only if it has been tested. The procedure, staffing, site access, communications and safety limits all need to work for as long as normal remote visibility or control is unavailable.
Only if they're current, protected and verified. Before restoration, the utility should confirm that the backup contains approved logic and doesn't reproduce the same unauthorized change.
Can the people responsible answer these questions?
Use this list with operators, IT staff, the controls integrator, utility leadership and the governing board. The questions are based on the FBI/EPA PSA, EPA/CISA HMI guidance and federal OT asset-inventory guidance.
Know what you have
- Do we have a current list of PLCs, HMIs, radios, modems, workstations, gateways and remote sites?
- Do we know which equipment is old, unsupported or approaching replacement?
- Do we know who installed, owns and maintains each major system?
Know what's connected
- Do we know every route that can carry data or commands into the control environment?
- Do we know which sites use radio, cellular, internet, vendor or backup connections?
- Do we know whether any computer, gateway or laptop connects to both business and control systems?
Know who can make changes
- Do we know who can change PLC programs, passwords, addresses and remote-access settings?
- Is vendor access approved, reviewed, logged and disabled when it isn't needed?
- Do we keep approved copies of PLC programs and important device configurations?
Know how you'd detect a problem
- Would we notice an unknown system communicating with control equipment?
- Would we know if a password, network setting or PLC program changed?
- Can we investigate activity across the PLC, HMI, workstation, gateway and connected network?
Know how you'd keep operating
- Is manual operation documented and tested under realistic conditions?
- Can operators safely run critical processes without normal remote visibility or control?
- Can staffing, site access and communications support extended manual operation?
Know how you'd recover and report
- Are backups current, protected, tested and verified as known-good?
- Can we confirm that a PLC program or configuration is approved before restoring it?
- Do operators, IT, integrators, leadership and communications staff know their roles?
- Do we know who contacts the FBI, CISA, state agencies and other required parties?
Every unanswered question should have an owner, a deadline and a documented answer. “The integrator knows,” “IT handles that,” “we have a firewall” and “I believe so” aren't complete answers.
What should water utilities do now?
The July 30, 2026 FBI/EPA PSA recommends removing PLCs from direct internet exposure, securing cellular modems, restricting network access, validating running logic, checking connected systems, testing manual operations and planning for end-of-life equipment. Read the PSA.
Find exposed and connected assets
Inventory PLCs, HMIs, modems, gateways and workstations. Identify direct internet exposure and every upstream route into the control environment.
Remove direct internet exposure
Don't leave PLCs directly reachable from the public internet. Broker required remote access through a secured, monitored gateway or jump host.
Restrict access and changes
Use unique passwords, tightly scoped firewall or ACL rules, and secure cellular modems with strong authentication and logging.
Validate logic and investigate upstream
Compare running PLC projects with known-good logic. Review available logs and configurations on connected modems, HMIs, workstations and gateways.
Test manual operation and recovery
Practice safe manual operation, verify backups before restoration, test communications and plan replacement or isolation of end-of-life devices.
Primary sources and further reading
The incident facts, attribution language and technical recommendations on this page were checked against the sources below. AA26-097A is included as broader threat context and isn't used to attribute the July 2026 water incidents.
The primary July 30, 2026 notice covering the affected PLC models, observed changes, operational effects and recommended actions.
View here → FBI Cyber Alert PageThe FBI's web version of the July 30, 2026 FBI/EPA public service announcement.
View here → CISA July 30, 2026 Water-Sector AlertCISA's alert on increased PLC targeting and immediate steps for water and wastewater systems.
View here → CISA AA26-097ABroader federal guidance on an attributed nation-state campaign targeting internet-connected PLCs across critical infrastructure. It doesn't attribute the July 2026 water incidents.
View here → WaterISAC on AA26-097AWater-sector summary of the advisory's updated scope, mitigations and utility actions.
View here → Minnesota IT ServicesThe official state notice on the coordinated attack targeting operational technology at more than 30 community water systems.
View here → CBS NewsReporting on affected utilities, manual operations and the investigation into a possible foreign link, which remained unresolved when CBS updated the story on August 1.
View here → NHPRReporting on how New Hampshire utilities and the Department of Environmental Services responded to the warnings.
View here → EPA/CISA HMI Fact SheetFederal guidance on internet-exposed HMIs, remote access, passwords, MFA, segmentation, allowlisting and monitoring.
View here → OT Asset Inventory GuidanceJoint guidance for identifying OT assets, connections, ownership, lifecycle status and communication details.
View here →During an active incident, preserve evidence, follow the utility's approved response procedures and coordinate with the responsible operator, engineer, controls integrator, regulator, public-health authority, FBI and CISA as applicable.
If you need help,give us a call.
Request an AssessmentThe utility and its authorized partners remain responsible for operational, engineering and regulatory decisions.