Water utility PLC attacks: the control layer that was never designed to authenticate

In July 2026, CISA reported malicious activity against more than 100 internet-exposed systems in the water and wastewater sector. The attacks mostly reached programmable logic controllers connected directly to cellular modems. At least twelve US states were involved, and several utilities confirmed incidents. The techniques were not sophisticated: scan for exposed controllers, log in with default or weak credentials, change the administrator password, change the device IP address, and lock the operators out.

That description is worth taking seriously, because it says the barrier to entry was configuration, not exploitation research.

What the attackers did

The reported actions were consistent across incidents. Attackers located controllers reachable from the internet, authenticated with default or weak credentials, modified the administrator password so the legitimate operator could not log in, and changed the device IP address so normal network communication stopped. In some cases the control logic itself was altered.

The operational effect was loss of remote visibility. Operators could no longer see pump status, valve positions, or pressure readings through the normal system. Some utilities reverted to manual readings and hand-operated valves. Reported physical effects included pressure loss and localised flooding.

Why the control layer is exposed

Programmable logic controllers were designed for availability and physical durability, not for hostile networks. Older models in widespread use have no native encryption, no certificate validation, and no multi-factor authentication. Protocols such as Modbus and EtherNet/IP were specified for trusted local networks and carry no authentication of their own.

The exposure comes from a practical decision. Remote monitoring is genuinely useful, and the fastest way to get it is to attach a cellular modem to the controller and reach it over the internet. When that modem is installed by a contractor and never entered into an asset register, the organisation may not know the path exists. CISA has described this as a cellular modem blind spot: perimeter controls do not see a connection nobody documented.

What the numbers do and do not show

Public measurement data indicates that thousands of industrial protocol hosts are reachable from the internet, with a large share in the United States. Those figures describe exposed services, not confirmed vulnerable or compromised devices. A controller that responds on port 502 or 44818 is reachable; whether it accepts default credentials is a separate question that the measurement does not answer. Treating exposure counts as a compromise count overstates the finding.

Defensive priorities

The first control is removing direct internet exposure. If remote access is required, it should go through a VPN or an industrial gateway with authentication, not a direct mapping from a cellular modem to the controller.

Default credentials must be replaced everywhere, including on devices that are considered internal. The reported attacks succeeded on default or weak passwords.

Network segmentation limits what a single compromised controller can reach. Flat networks let an attacker move from one device to the next.

Backups matter more than usual here. A clean offline copy of controller logic and configuration allows recovery when an attacker has changed the password and the program. Without it, restoring a locked controller can require a site visit.

Finally, inventory the undocumented connections. The cellular modems in these incidents were often installed for convenience and never recorded. An asset register that omits them cannot protect them.

Uncertainty

Attribution for the July 2026 campaign was not formally established by US authorities at the time of reporting. Some security vendors drew comparisons to earlier activity against industrial control systems, and press reporting noted speculation about state-linked actors, but official statements described the actors only as malicious cyber actors. The count of more than 100 affected systems is an external observation figure, not a confirmed count of successful intrusions. This article does not assert attribution.

References

• CISA alert on water and wastewater systems, July 2026, https://www.cisa.gov/news-events/alerts/2026/07/30/fbi-epa-water-wastewater-systems
• CISA/NSA/FBI/DOE/EPA joint advisory AA26-231A on exploitation of internet-exposed operational technology, https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a
• CISA guidance on reducing internet exposure of operational technology
• Forescout Vedere Labs research on exposed industrial controllers