CISA: Over 100 Water Sector OT Systems Targeted in July 2026 Cyberattacks

The U.S. Cybersecurity and Infrastructure Security Agency reported that more than 100 internet-exposed systems in the water and wastewater sector were targeted by malicious actors in July 2026. Attackers identified and targeted programmable logic controllers connected directly to cellular modems, exploiting configurations that allowed public internet reachability without passing through corporate IT networks. Iran-linked threat actors have been cited in broader attribution related to this activity. No critical operational disruptions, water outages, or water quality impacts have been confirmed as a result of the attacks. CISA has urged water utilities to remove direct internet exposure, enforce strong credentials, apply firmware updates, and implement multi-factor authentication to reduce attack surface.