Threats · 47 days ago
CISA said it observed malicious activity against more than 100 internet-exposed water and wastewater systems in July, and it tied the activity to PLCs left reachable through cellular modems or the public internet. The agency’s update gives a number to what had been treated as scattered incidents across small utilities.
The pattern is the exposure itself: programmable logic controllers at the edge of the network can be reached directly, so attackers do not need a normal enterprise foothold to probe or revisit them. In that setup, the control layer is the target, and a response that only looks for malware inside the plant can miss the reachable device that made the attack possible.
For water operators, the lasting issue is the trust boundary. If PLCs sit online, the same campaign shape can be reused against other rural or lightly staffed sites, and the exposure stays with whoever can still reach those controllers after the headlines fade.
4 sources covering this story
More than 100 water systems were hit in July cyberattacks
'These are test runs for a larger-scale attack'
CISA confirms hackers targeted over 100 US water systems during July | TechCrunch
The federal cyber agency's warning comes amid a wave of suspected Iran-backed cyberattacks targeting critical water systems across the United States.
CISA: Over 100 Internet-Exposed Water Systems Targeted in July Cyberattacks
The agency has released guidance on reducing internet exposure in the wake of the recent Iran-linked hacker attacks.
Water sector passes, government sector fails attempts to spot and halt simulated CISA attack
A new CISA red-team report reveals a water facility quickly detected and blocked a simulated cyberattack, while a government organization failed to act on security alerts.
Part of the PlainSec briefing for 2026-08-27