Attack on over 100 US water systems: Internet-exposed PLCs targeted in July

The Cybersecurity and Infrastructure Security Agency (CISA) observed malicious cyber activity in July 2026 against more than 100 systems belonging to the Water and Wastewater Systems (WWS) sector in the United States. The agency recently released an updated guide on reducing internet exposure, revealing that the most common vector was direct access to programmable logic controllers (PLCs) connected via cellular modems and therefore reachable from the public network. A related advisory is dated July 30, 2026.

Over 100 water systems targeted

CISA confirmed that during July 2026 it detected intrusion attempts and unauthorized accesses against more than 100 internet-exposed systems in the US water and wastewater sector. This is not a single isolated incident, but a coordinated wave of malicious activity that hit critical infrastructure spread across multiple states.

The WWS sector includes water treatment plants, distribution networks, sewer systems, and wastewater treatment facilities. Many of these facilities, often managed by small municipalities or private companies with limited resources, use industrial control systems (ICS) and operational technology (OT) to monitor and manage processes. Their direct exposure to the internet, often without adequate security measures, made them easy targets.

The vector: PLCs connected directly to cellular modems

The most exploited entry point was the direct connection of PLCs to cellular modems. In practice, devices designed for controlling physical processes – such as valves, pumps, level sensors, and chemical dosing systems – were reachable by anyone on the internet because they were connected via a SIM card and a cellular modem, without passing through secure gateways, VPNs, or firewalls.

PLCs are not the only exposed assets. CISA also cites human-machine interfaces (HMIs), remote terminal units (RTUs), SCADA components, and IIoT devices. All these elements, if connected directly to the public network, can be identified with scanning tools like Shodan or Censys and then attacked with relative ease.

The problem is not new. Protocols such as Modbus, EtherNet/IP, DNP3, and OPC UA, often used in OT environments, were not designed to be exposed to the internet without protections. When they are, anyone can attempt to read or modify their state.

What the attackers did: IP and passwords changed

According to CISA, the attackers obtained unauthorized remote access to the exposed PLCs. Once inside, they modified the IP addresses of the devices and changed the passwords. This simple action had immediate consequences: legitimate operators lost the ability to monitor and control processes because the systems stopped responding to commands or became unreachable.

In some cases, CISA reports localized operational interruptions. The loss of supervisory and control functionality, even without direct physical damage, can prevent the regulation of pumps, the management of chlorine levels, or the detection of anomalies. SecurityWeek, which first reported the news, downplays the impact by stating that there were no significant disruptions. The two assessments diverge: CISA highlights real but contained damage, while SecurityWeek emphasizes that no water service was left out of service on a large scale.

The prospective risk, however, is high. The ease with which these systems were compromised demonstrates how fragile OT security is when proper network segmentation is lacking.

Uncertain attribution and the map of states

On the identity of the attackers, sources disagree. SecurityWeek explicitly links the attacks to groups tied to Iran, citing previous operations against US critical infrastructure. The CISA guide, instead, does not provide any explicit attribution.

There is also no official confirmation on the number of states involved. The federal government has not disclosed how many states experienced intrusion attempts. SecurityWeek estimates at least 12, and six have publicly confirmed the incident: Minnesota, Michigan, South Dakota, Georgia, New Jersey, and Alabama.

Shortly before the guide's publication, CISA had already warned of Iran-linked attacks against industrial control systems from Siemens, Schneider Electric, and Rockwell Automation. It is not specified whether these three vendors are directly involved in the July 2026 wave, but the context suggests a continuity of interest in American OT by state actors or affiliates.

CISA's four moves to reduce exposure

The CISA guide outlines a four-step path to help water sector organizations – and more generally all critical infrastructure – reduce their attack surface.

1. Assess current exposure. Identify all internet-accessible assets using internal inventories and external scanning tools such as CISA's Cyber Hygiene Vulnerability Scanning, Shodan, Censys, Thingful, or Shadowserver. Also verify third-party remote accesses: integrators, MSSPs, vendors, and any connections via VPN or cellular modem.

2. Assess the necessity of exposure. Ask whether each asset truly needs to be reachable from the internet. If the answer is no, completely remove access or significantly restrict it.

3. Mitigate risks on assets that must remain exposed. Change all default passwords, apply security updates, replace unsupported software and devices, use a jump host for secure and monitored access, control inbound and outbound traffic, implement multi-factor authentication (MFA) – even just at the jump host level – and follow guidance for secure remote access to OT environments.

4. Establish periodic assessments. Networks and third-party connections change continuously: it is necessary to regularly review exposed assets.

Regarding secure remote access, CISA recommends routing all traffic through secure gateways, firewalls, VPNs, or other centralized solutions, never directly to PLCs, HMIs, or RTUs. Every access must require unique usernames, strong passwords, and phishing-resistant MFA. Authentication controls must withstand brute-force attempts and attacks based on stolen credentials.

Tools and checks to discover your exposed assets

CISA also provides operational guidance for defenders. Organizations should periodically scan their public IP ranges and investigate every unexpected open port. An open port does not automatically imply a vulnerability, but every exposed OT or remote access service must be justified: if it is not necessary, it should be removed; if it is, mitigations should be applied.

Tools such as Shodan, Censys, Thingful, and Shadowserver allow discovering exposed assets. For the CIP protocol (port 44818), CISA suggests queries like:

• Censys: host.services.port: 44818 and host.ip: "X.X.X.X/Y"
• Shodan: port: 44818 net:X.X.X.X/Y

The list of minimum ports to check includes classic remote access services – SSH (22), Telnet (23), HTTP (80), HTTPS (443), RDP (3389), VNC (5900), TeamViewer (5938) – and the most common industrial protocols: Modbus (502–507 and other implementations), EtherNet/IP (44818/TCP and 2222/UDP), DNP3 (19999/UDP and 20000/TCP/UDP), OPC UA (4840/TCP and 4843/TCP), BACnet (47808/TCP), plus Niagara Fox (1911/TCP and 4911/TCP).

Water sector organizations can also take advantage of CISA's free Cyber Hygiene services, regional Cybersecurity Advisors, and WWS-specific resources curated by CISA and EPA. For reporting, the address [email protected] is available.

The story fits into a broader context: Congress is evaluating a bill to strengthen water cybersecurity and the creation of a "Water Watch Center." OT security, especially in less protected sectors, has become a national priority.