Since July 26, 2026, water and wastewater utilities in the United States and Canada have reported cyber incidents involving internet-facing programmable logic controllers (PLCs).
On July 30, the Federal Bureau of Investigation (FBI) and Environmental Protection Agency (EPA) warned that a series of cyberattacks had affected water and wastewater operators across multiple U.S. states. The activity focused on exposed Rockwell Automation/Allen-Bradley MicroLogix controllers, with attackers interfering with device configuration and, in at least one case, altering PLC project files. The resulting impact included loss of remote visibility or control and other operational disruption.
VenariX is tracking the campaign as additional utilities confirm impact. Use the
critical infrastructure attacksearch tag to find related incidents across critical infrastructure sectors.
Confirmed Impacted Utilities
The following organizations have publicly confirmed incidents associated with this activity:
VenariX is tracking the campaign by recording each confirmed incident in the platform, allowing the broader scope, affected organizations, operational impact, and recurring technologies to be analyzed as the campaign develops.
The publicly identified organizations do not represent the full scope of the campaign. The FBI reported incidents in at least seven states by July 30 and noted that some activity had already degraded water operations.
Observed Activity Against PLCs
A programmable logic controller, or PLC, is an industrial computer used to monitor and control physical equipment. In water and wastewater environments, PLCs may operate pumps and valves, regulate pressure and flow, monitor tank levels, and trigger alarms based on process conditions.
The current attacks have targeted PLCs that are reachable from the public internet. The FBI reported that attackers changed controller settings, including IP addresses and passwords, which in some cases disrupted operators’ ability to communicate with the equipment. Reported effects included pressure loss and flooding.
In at least one case, investigators also identified changes to PLC project files after finding differences in ladder logic across multiple sites. Ladder logic is the control program that determines how a PLC responds to inputs and operates connected equipment.
The operational risk depends on the controller’s function. Compromising a PLC used only for telemetry may affect monitoring. However, compromising a PLC that controls pumps, valves, or pressure can directly affect the physical process.
Remote Access and Internet Exposure
Water and wastewater utilities often need remote access because treatment plants, wells, pump stations, lift stations, and other facilities may be spread across a large geographic area and may not be continuously staffed. Operators, engineers, and third-party integrators still need a way to monitor equipment and perform maintenance without traveling to each site.
When a PLC or its management interface is exposed directly to the public internet, an external user can reach the controller without first passing through the utility’s enterprise network, VPN, or other access-control layer. That removes an important barrier between the internet and the control system.
NIST, the FBI, and EPA recommend placing PLCs behind controlled access points such as OT firewalls, VPNs, secure gateways, or jump servers. Remote access should be restricted to approved users and systems, with logging and source restrictions applied before traffic reaches the controller.
OT Security Controls for Water Utilities
Utilities should begin by identifying PLCs, HMIs, cellular modems, engineering workstations, and other OT assets that are reachable from outside the control network. The current campaign shows that direct exposure of PLCs can provide attackers immediate access to controller settings and, in some cases, the physical processes those controllers manage.
Priority actions include:
Remove direct internet access to PLCs and other control-system devices.
Route remote access through a managed gateway, VPN, or jump server.
Restrict PLC communications with firewall rules or access control lists so that only approved systems can connect.
Secure cellular modems used for remote field access, including strong authentication, logging, and private or isolated connectivity where practical.
Replace default or weak device credentials with unique passwords and two-factor authentication where feasible.
Keep PLC key switches or software operating modes in
Runwhen programming changes are not required.Maintain validated copies of PLC programs, ladder logic, configuration, and I/O mappings.
Compare the running project against a known-good baseline when compromise is suspected.
Review logs and configuration from connected HMIs, modems, engineering workstations, and other OT devices for signs that access extended beyond the PLC.
Maintain tested manual operating procedures so critical processes can continue if remote monitoring or automated control is unavailable.
Track end-of-life controllers and either replace them or isolate them with compensating controls when replacement is not immediately possible.
NIST’s 2026 guidance for water and wastewater utilities places the same emphasis on controlled remote access: remote users should authenticate through an intermediary system before reaching OT equipment, with access limited to the systems and functions they are authorized to use.
If a PLC has already been compromised, restoring a backup should not be treated as sufficient by itself. The project file should first be checked against a trusted copy, and connected OT devices should be reviewed for unauthorized configuration changes or additional access before returning the controller to service.
Third-Party Integrator Access
The FBI noted that several affected utilities had similar network configurations and that some of those configurations had been implemented by third-party providers.
That creates a repeatable risk. Water utilities often rely on integrators for PLC programming, SCADA support, network connectivity, and remote maintenance. If the same remote access design is deployed across multiple customers, a weak configuration can expose more than one utility to the same attack method.
Utilities should review how integrators reach OT systems, whether remote access is always enabled, whether credentials are shared across customers or sites, and whether the same modem, firewall, or PLC configuration has been reused across multiple facilities.
Manual Operations and Recovery
The ability to operate critical water and wastewater processes manually is an important part of OT resilience. If remote communications, SCADA visibility, or automated control are lost, operators still need a way to maintain essential functions safely.
Manual procedures should cover the systems most likely to be affected by the loss of PLC or SCADA access, including pumps, valves, pressure control, and treatment processes. Those procedures should be tested regularly and supported by validated backups, standby equipment, and documented recovery steps.
The FBI and EPA recommend maintaining and exercising manual operating capability so utilities can continue essential operations while affected OT systems are isolated, investigated, or restored.
