The U.S. Cybersecurity and Infrastructure Security Agency issued an urgent alert on July 30, 2026, telling water and wastewater utilities to immediately disconnect programmable logic controllers (PLCs) from the internet. Threat actors are targeting the controllers, changing passwords and IP addresses to lock out operators, and the activity has already forced boil-water notices and manual operations at some facilities.

The scope of the attack

The alert—developed with input from the Environmental Protection Agency and the FBI—warns that cyber actors are going after internet-exposed PLCs in water and wastewater systems of every size. Even organizations with mature cybersecurity programs need to validate their external connections. Attackers aren't just scanning for vulnerable systems; they're actively modifying controller configurations, disrupting treatment processes, and, as CISA puts it, potentially creating conditions for physical damage.

A critical hidden risk: cellular modems. These can be installed by internal teams, vendors, or system integrators and may not appear in routine asset inventories or perimeter scans. A modem that pokes a hole directly to a PLC turns that controller into a publicly reachable device—and an attacker's entry point. CISA says operators should assume that any undocumented modem is an open door until proven otherwise.

The agency notes that this activity has already resulted in real-world consequences: boil-water notices and the need to sustain manual operations. That means operators on site because they can't trust remote readings or controls, with the public potentially boiling water until the system is restored. For a sector that prizes reliability, it's a blunt reminder that a cyberattack on OT isn't just a data breach—it's a health and safety incident.

What this means for you

If you're a water utility operator or engineer, the immediate priority is to find every PLC that's reachable from the public internet and sever that connection. This isn't a suggestion—it's an operational necessity. Look for fixed public IP addresses assigned to controllers, cellular gateways, vendor-managed remote tools, legacy NAT rules, and temporarily deployed troubleshooting equipment. Once you've disconnected the PLCs, verify that you have a known-clean backup of every controller's configuration and firmware. If an attacker already changed a password, that backup may be the only way to regain access.

For remote operational needs, CISA says access must terminate at a VPN or a properly controlled gateway device—not at the PLC itself. Simply hiding a controller behind a home router or a basic firewall isn't enough. The gateway should enforce strong authentication, logging, and ideally restrict source IP addresses to known engineering laptops or other critical OT assets. Default or weak passwords on PLCs must be replaced immediately. These are fundamental controls, but the alert illustrates that they're often missing in the field.

If you're an IT administrator supporting a water utility, your job just extended beyond patching Windows servers. A perfectly managed domain doesn't matter if a cellular modem linked to a PLC sits on a separate network path that you've never scanned. The alert specifically calls out the possibility of undocumented connections. Work with your OT engineers to map every external-facing asset that could touch a controller. That inventory needs to include equipment installed by third parties—integrators, support vendors, or even an operator who plugged in a hotspot for convenience. CISA recommends allowlisting IPs so that only authorized systems can initiate remote sessions.

This is also a moment to review access to engineering workstations. Many are Windows-based machines that sit in the IT domain but have specialized software to talk to PLCs. If one of those workstations gets compromised, an attacker could pivot to the OT network. Segment them properly and ensure they don't have unrestricted internet access.

For the general public, the alert is a sobering reminder that critical infrastructure runs on industrial control systems that are increasingly connected—and often poorly secured. A cyberattack on a water plant isn't a distant threat; it's something that can lead to a boil-water advisory in your community. If that happens, follow official guidance, and understand that it's not just a mechanical failure—it might be a deliberate act. While you personally can't fix the PLC, supporting investment in your local utility's cybersecurity posture matters.

How we got here

The targeting of internet-exposed industrial controllers isn't new, but the pace has quickened. Back in 2021, the Oldsmar, Florida water treatment plant attack used a compromised TeamViewer session to raise sodium hydroxide levels—a direct intervention in a live control system. That incident didn't involve an exposed PLC per se, but it showed how remote access paths can be abused. Since then, CISA and the EPA have repeatedly warned about vulnerabilities in OT: default credentials, lack of segmentation, and controllers reachable via Shodan or similar search tools.

In 2023 and 2024, a wave of attacks targeted water utilities with Unitronics PLCs, exploiting unchanged default passwords to tamper with operations. CISA advisories at the time stressed the same message: disconnect the controllers from direct internet exposure. Yet many organizations remain connected. The reasons are practical—remote monitoring and maintenance save time and money. But the security boundary often ends at the corporate firewall, leaving the controller naked to attackers who can scan industrial protocols on common ports.

The current activity appears more aggressive. Instead of just probing or defacing a Human-Machine Interface (HMI), threat actors are changing the controller's IP address and password, effectively locking out the legitimate operator. That shifts the burden to the victim: you can't just block the attacker; you may lose the ability to monitor and control your plant until you physically access the PLC and restore a clean configuration. For a water system, that could mean hours or days of manual control and a boil-water advisory.

The inclusion of the FBI in this alert signals that law enforcement sees criminal intent, not just opportunistic hacking. And the EPA's involvement ties the message to regulatory expectations: water utilities have a responsibility under the Safe Drinking Water Act to maintain resilient operations. An internet-exposed PLC with default credentials likely fails a risk and resilience assessment.

What to do now

CISA's guidance is straightforward but must be executed with care. Here’s a step-by-step prioritization, based on the alert and supplementary best practices:

  1. Inventory and disconnect – Find every PLC or other OT device with a direct internet connection. Include cellular modems, third-party remote access appliances, and any oddball NAT rule that might be forwarding traffic. Disconnect them from the public internet immediately. This action alone closes the most critical exposure.

  2. Secure remote access – Before re-enabling any remote management, stand up a VPN or authenticated gateway that sits between the internet and the OT network. That gateway must enforce multi-factor authentication, strong passwords, and logging. If possible, restrict inbound connections to a list of known IP addresses (CIDR blocks) belonging to engineering workstations or vendor support locations.

  3. Change all passwords – If the PLC has a password, change it from the default. Even if the controller doesn't require a password by default, enable password protection. This includes web interfaces, programming ports, and any embedded HMI. If an attacker already changed the password, you'll need a clean backup image to regain control (see below).

  4. Verify backups – After disconnecting a PLC, ensure you have a known-good, offline backup of its logic, configuration, and firmware. For operators who suspect compromise, test that the backup can be restored to an identical controller before attempting it on the live system. For Rockwell Automation MicroLogix 1400 users, North American Rockwell has published a special notice on restoring access when the password is unknown—seek that out if you're locked out.

  5. Revisit third-party access – Demand that vendors, integrators, and service providers document every cellular or remote path they've installed. Make remote access for support a temporary, supervised activity rather than a persistent tunnel. If you must use a vendor's remote tool, ensure it terminates at a gateway under your control, not at the PLC.

  6. Report incidents – If you believe your system has been targeted or compromised, contact CISA’s 24/7 Operations Center ([email protected] or 1-844-729-2472) and the FBI’s Internet Crime Complaint Center. Include the date, time, location, type of activity, and any indicators of compromise. The agencies need this intelligence to track threat actors and warn others.

  7. Leverage free assistance – The EPA’s Cybersecurity Technical Assistance Program for the Water Sector and CISA Regional Offices offer no-cost assessments and guidance. For many smaller utilities with limited resources, these services can bridge the gap between awareness and action.

The road ahead

This alert is unlikely to be the last. With Congress and regulators paying closer attention to water sector cybersecurity, expect more mandatory requirements—possibly similar to TSA directives for pipelines. The bipartisan Water Systems Cybersecurity Act and EPA’s efforts to expand its regulatory reach signal that voluntary guidance may give way to enforceable standards. For utilities, that means treating OT security not as an IT sideline but as a core operational function, funded and staffed accordingly.

One immediate indicator to watch: whether CISA converts its voluntary alert into a Binding Operational Directive for federal agencies, which often cascades into de facto standards for critical infrastructure. Either way, the days of leaving a PLC’s web interface exposed on a public IP address should be over. The hackers have already proven they’ll use that access—and the public will feel the consequences.