CISA Warns Water Utilities: Find Your Exposed PLCs Before Attackers Do
CISA urged water utilities to secure internet-exposed PLCs after July 2026 attacks compromised over 100 US water and wastewater systems, suspected Iran-linked.
CISA's exposure-reduction guidance, published August 21, follows July 2026 attacks in which threat actors remotely accessed PLCs connected directly through cellular modems, changed device IP addresses and passwords, and in some cases disabled alarms and shutdown processes without notifying operators. Iran is the suspected actor, though officials stopped short of formal attribution. CISA recommends routing remote access through centrally managed secure gateways, phishing-resistant MFA, unique credentials, and external scanning of industrial protocols such as Modbus, EtherNet/IP, DNP3, BACnet and OPC UA.
- Over 100 internet-exposed systems hit in the US water and wastewater sector in July 2026
- Direct PLC-to-cellular-modem connections with no firewall or gateway enabled attacker access
- Attackers altered device configurations and disabled alarms, creating unsafe conditions for operators
- Guidance: secure gateways, phishing-resistant MFA, unique credentials, and monitoring of OT ports and protocols
- Vendors
- CISA
- Products
- programmable logic controllers
- Threat actors
- Volt Typhoon
- Organizations
- CISA
- Countries
- United StatesIran
From the original article
3 min read at securityaffairs.com
CISA urges water utilities to find and secure internet-exposed PLCs after July attacks showed how easily exposed industrial systems can be compromised. Over 100 internet-exposed systems in the US water and wastewater sector got hit by cyberattacks in July 2026, and CISA’s response wasn’t just an incident report, it was a how-to guide for making sure it doesn’t happen to you next.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.