CISA Warns Water Utilities of Attacks Locking Operators Out of Internet-Exposed PLCs

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency alert on July 30, 2026, warning water and wastewater facilities of ongoing attacks targeting programmable logic controllers (PLCs) directly exposed to the internet. Threat actors are exploiting default or weak credentials to access PLC management interfaces, then changing passwords and network configurations to lock out legitimate operators. The attacks disconnect equipment from remote monitoring systems, forcing facilities to switch to manual operations and risking physical disruptions such as pressure drops and equipment malfunctions. CISA has not attributed the activity to a specific threat group and confirmed no universal physical damage, though configuration tampering poses potential safety risks. The agency is urging operators to remove PLCs from direct internet exposure, enforce strong authentication with MFA, implement VPNs, and maintain offline configuration backups for rapid recovery.