CISA said it observed malicious activity against more than 100 internet-exposed water and wastewater systems in July, and it tied the activity to PLCs left reachable through cellular modems or the public internet. The agency’s update gives a number to what had been treated as scattered incidents across small utilities.
The pattern is the exposure itself: programmable logic controllers at the edge of the network can be reached directly, so attackers do not need a normal enterprise foothold to probe or revisit them. In that setup, the control layer is the target, and a response that only looks for malware inside the plant can miss the reachable device that made the attack possible.
For water operators, the lasting issue is the trust boundary. If PLCs sit online, the same campaign shape can be reused against other rural or lightly staffed sites, and the exposure stays with whoever can still reach those controllers after the headlines fade.