The U.S. Cybersecurity and Infrastructure Security Agency warned of a significant increase in cyberattacks targeting internet-exposed programmable logic controllers in water and wastewater systems [1].
These attacks target the critical hardware that manages water flow and treatment, creating potential risks for public health and the stability of municipal infrastructure.
Federal officials identified incidents in at least seven states [2]. These locations include Georgia and Michigan, where water systems were reportedly compromised [3]. The attacks focused on programmable logic controllers, known as PLCs, which are often exposed to the open internet, making them vulnerable to remote exploitation [1].
Reports indicate the incidents occurred during the first week of August [2, 3]. Some reporting suggests the campaign is linked to hacker groups backed by Iran amid heightened tensions between the U.S. and Iran [3]. However, the FBI has not publicly attributed the campaign to a specific actor [2].
CISA continues to urge utility operators to secure their industrial control systems and remove PLCs from public internet access to prevent further disruptions [1]. The agency said that the vulnerability of these systems stems from a lack of robust authentication, and the use of outdated software in municipal facilities [1].
Water utilities in the affected states are currently working with federal authorities to assess the extent of the breaches and ensure that water quality and delivery remained unaffected during the incursions [2, 3].
“CISA warned of a significant increase in cyberattacks targeting internet-exposed programmable logic controllers.”
The targeting of PLCs represents a shift from data theft to potential operational disruption. By accessing the controllers that manage physical processes, attackers can theoretically alter chemical levels or shut down water distribution. This highlights a systemic vulnerability in U.S. municipal infrastructure where legacy hardware is connected to the modern internet without adequate security layers.
