Since July 27, water and wastewater utilities in at least seven states have reported cyberattacks against internet-facing programmable logic controllers (PLCs).
Last week: an interagency alarm from the FBI and the EPA
Last week, the FBI and the EPA issued a joint alert after a wave of incidents against water and wastewater utilities. The agencies described intrusions into internet-facing PLCs — the small industrial computers that operate pumps, valves, and treatment equipment — and warned that some attacks had degraded operations, producing pressure loss and flooding and forcing several systems to revert to manual control. One Minnesota community declared a local state of emergency.
How the attackers got in and what they did
The intrusions did not rely on zero‑day exploits or novel malware. According to the alert, attackers found controllers exposed to the public internet — many so old they no longer received security patches — logged in, changed IP addresses and passwords, and locked operators out. In at least one case, the attackers modified ladder logic that controls industrial equipment. The pattern is blunt and familiar: exposed devices, default or shared credentials, and project files altered after access was gained.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildWhy this keeps happening: scale, structure, and economics
The alert framed the problem as structural as much as technical. The United States has roughly 50,000 community water systems; most are small, publicly funded, and run by operators whose primary duty is keeping water safe and flowing. Cybersecurity often ranks far below that mission — if it ranks at all. Devices implicated in these incidents are frequently a decade or more old, and replacing them requires capital many utilities lack. Rules governing water cybersecurity remain mostly voluntary, creating the economic conditions attackers are exploiting.
Attackers have shifted tactics and amplified scope
The alert linked the current wave to earlier incidents, noting a pattern since late 2023 when controllers were compromised at utilities in several states, including a widely reported incident in Aliquippa, Pennsylvania. Where early intrusions sometimes amounted to defacements, attackers have moved toward operational disruption across dozens of systems at once. The agencies highlighted a recurring enabler: third‑party integrators deploying the same vulnerable configuration across many small utilities, allowing a single exploit or set of credentials to cascade into multiple sites.
Practical steps the FBI and EPA say utilities can take this week
- Get controllers off the public internet: No PLC should be reachable from the outside world. Remote access should go through a secure gateway that mediates, monitors, and logs every connection — this includes cellular modems, which the alert says are an overlooked entry point.
- Fix passwords: Default and shared credentials remain the most common initial access vector. Strong, unique passwords are the cheapest and most effective immediate control available.
- Restrict communications: Apply firewall rules and access control lists to permit only expected communication between known control system devices, and block traffic from hosting providers and other sources that have no business touching a water plant.
- Lock the logic: Keep physical and software key switches in the run position except during authorized updates to prevent unauthorized changes to configuration and firmware.
- Practice manual operations: Utilities that switched to manual control quickly fared best; the alert emphasizes that running manually is a practiced skill, not an emergency improvisation.
- Verify inventories: Many operators believe PLCs aren’t internet‑exposed until an inventory proves otherwise. Forgotten modems, integrator‑installed remote access, and devices nobody knew were still online are common finds.
- Implement continuous OT monitoring: Every reported attack followed a pattern — configuration changes, password resets, modified project files — each of which generates network signals before operations degrade. Continuous monitoring turns those signals into minutes‑level alerts instead of days.
What this means for technologists, regulators, and utilities
- Technologists and security teams: Prioritize discovery and monitoring of OT assets, block unexpected sources of traffic (including hosting providers), and treat cellular modems as networked endpoints that require the same controls as wired connections.
- Policymakers and regulators: The alert underscores that voluntary rules have not prevented recurring incidents; the scale (roughly 50,000 community systems) and the prevalence of aging devices shape any response and resource decisions.
- Utilities and procurement leaders: Capital constraints and third‑party configurations are central risks — verify integrator settings, inventory all remote access points, and budget for both device replacement and the relatively low‑cost controls the agencies recommend.
The FBI and EPA have described both the problem and a set of concrete, low‑cost defenses. Attackers are no longer merely testing whether defenses exist — for the third time in three years, they are probing whether utilities will act. The difference between detection in minutes and detection in days is not academic here: it can be the difference between an incident report and a boil‑water notice. The agencies’ message is unambiguous — act on their guidance this week, not later.
