Threats · 45 days ago
The hard failure here is loss of operator control, not just a noisy intrusion. Once someone can reach a PLC’s management plane, they can change passwords and IP settings, cut operators off, and leave the site running only in manual mode.
CISA says it is seeing a significant increase in attacks on internet-exposed PLCs in water and wastewater systems. The agency says the activity has already caused boil water notices and sustained manual operations, and that the exposed paths can include cellular modems installed by operators, vendors, or system integrators that never made it into routine inventory.
That means perimeter scans that only look for obvious internet-facing devices miss the real trust path. If the control plane is reachable, the attacker can rewrite who is trusted to manage the plant, and the lockout can persist even after the initial access point is found.
4 sources covering this story
The Record from Recorded Future
CISA warns of spike in attacks on water systems as Minnesota incidents probed
The Cybersecurity and Infrastructure Security Agency said in a public alert on Thursday that facilities should “remove publicly exposed PLCs and other operational technology (OT) from the internet as soon as possible."
CISA warns of cyberattacks disrupting U.S. water utilities
Cybersecurity and Infrastructure Security Agency (CISA) is warning of a significant increase in attacks targeting internet-exposed programmable logic controllers (PLCs) in the water and wastewater systems sector.
CISA Urges Water Sector to Protect OT After Coordinated Attacks on PLCs
CISA is urging water and wastewater utilities to lock down internet-exposed controllers, days after intrusions hit dozens of Minnesota systems.
CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs | CISA
CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs CISA is currently observing a significant increase in cyber threat actors targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems (WWS) Sector.
Part of the PlainSec briefing for 2026-08-03