Keeping Water Utilities Safe from Cyberattacks

Attackers Are Hijacking Internet-Facing PLCs at Water Utilities: What Happened, and How to Keep It From Happening to You

On July 30, 2026, the FBI and EPA issued a joint public service announcement warning water and wastewater operators that malicious cyber actors are actively attacking operational technology (OT) devices exposed to the internet. Since July 27, utilities in at least seven states have reported incidents to the FBI, and some of that activity degraded water operations. The observed attacks targeted Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers (PLCs), but the agencies are clear that any brand of internet-facing controller faces the same risk.

What Happened

The consequences were operational, not just informational. After remotely accessing internet-facing PLCs, the attackers changed device IP addresses and turned on or changed passwords, locking operators out of their own equipment. The result was a loss of view and, in some cases, a loss of control of connected equipment. At least one utility discovered modified PLC project files, caught only because the ladder logic no longer matched across the utility’s other sites.

Reported operational effects included loss of pressure and flooding. Pressure loss in a water system is not a minor event: it can allow untreated groundwater to seep into distribution piping, turning a cybersecurity incident into a potential public health issue. How badly each utility was hit depended on whether the compromised PLC was monitoring or controlling equipment, which functions it supported, and, critically, whether staff could fall back to manual operation.

How the Attacks Worked

Nothing about these intrusions was exotic. The attackers did not need zero-day exploits or nation-state tooling. They reached controllers that were directly exposed to the public internet, often through cellular modems at remote sites, and used the devices’ own configuration features against their owners: changing IP addresses to break communications and setting passwords to block legitimate access.

The FBI also noted a multiplier effect: several victims had similar network setups delivered by the same third parties. When an integrator deploys the same vulnerable architecture across many customers, one successful attack becomes a repeatable playbook. Who designs and maintains your OT network matters as much as the equipment in it.

What the FBI and EPA Recommend

The joint advisory lays out specific defensive measures. Every one of them is achievable for a utility of any size:

• Get PLCs off the public internet. Remove all inbound port exposure. Remote access should never reach a controller directly; broker every session through a secure gateway or jump host so access is mediated, monitored, and logged. Secure cellular modems with strong authentication, keep them updated, and isolate field connectivity with a private APN, cellular SD-WAN, zero trust network access (ZTNA), or a site-to-site VPN.
• Use strong, unique device passwords. Complex, unique combinations that are not shared across devices or guessable from public information.
• Strictly control network access to PLCs. Configure firewall rules and access control lists (ACLs) to allow only authorized communication between expected control system devices, and block traffic from unauthorized sources such as hosting-provider IP ranges, where attacker infrastructure typically lives.
• Keep key switches in RUN. Physical and software key switches left in program or remote mode allow unauthorized changes to logic, configuration, and firmware. Switch to program mode only when actively updating, validate the project file first, and switch back immediately when done.
• Maintain the ability to operate manually. The utilities that fared best could revert to manual control. Business continuity plans, fail-safe mechanisms, islanding capabilities, backups, and standby systems should be routinely tested, not just documented.
• Review project files for unauthorized changes. Use vendor integrity-checking tools and visually compare running programs against known-good logic. Before restoring any backup, verify it does not contain malicious changes, and review logs on connected modems, HMIs, and workstations for signs of lateral movement.
• Plan for end-of-life replacement. Devices past end-of-life no longer receive security patches and are routinely targeted. Maintain a rolling 12-month EOL forecast, track affected assets by product, owner, and location, and replace or isolate them, with compensating controls and firm decommission dates where replacement must wait.

The Standards That Make Systems Resilient

None of this guidance is new. The weaknesses exploited in July are exactly what established industrial cybersecurity standards are designed to eliminate:

• ISA/IEC 62443 is the international standard family for industrial automation and control system security. Its zones-and-conduits model segments the network so a compromised device cannot reach everything else, and its security levels give asset owners a way to specify and verify how much protection a system must provide. It also assigns explicit security responsibilities to system integrators, which speaks directly to the third-party design weaknesses the FBI observed.
• NIST SP 800-82 and the NIST Cybersecurity Framework provide the reference architecture and risk-management structure for OT environments, including guidance on network segmentation, remote access, and incident response tailored to control systems.
• AWWA’s Water Sector Cybersecurity Risk Management Guidance translates these frameworks into practices scoped for water and wastewater utilities, aligned with EPA requirements.
• Federal water-sector guidance, including the joint Incident Response Guide for the Water and Wastewater Sector and Top Cyber Actions for Securing Water Systems, distills these standards into prioritized actions. The PSA further instructs operators to follow the Secure Connectivity Principles for Operational Technology, cross-sector OT guidance issued by CISA and the UK NCSC in January 2026.

A control system engineered and maintained against these standards does not present internet-facing PLCs, default credentials, or flat networks to an attacker. The July campaign succeeded where those fundamentals were missing.

What You Can Check This Week

Start by knowing where you stand. Much of the following can be checked quickly without breaking the budget:

• Find every internet-facing device. Direct exposure was the root cause in every reported case. Inventory anything with a public IP or an inbound port forward reaching OT: controllers, HMIs, historians, and especially cellular modems at remote lift stations and pump houses.
• Eliminate default, weak, and shared credentials. Every device gets a unique, complex password, and every person gets their own account. Shared logins leave no way to tell who made a change.
• Manage access from one central account system. When each device keeps its own local accounts, those lists drift apart fast. Point switches, firewalls, HMIs, and remote-access gateways at a central directory and grant access by role, so adding or removing a user is one change in one place.
• Segment the network and let the firewall police it. Put each kind of traffic on its own VLAN rather than one flat network: controller-to-controller traffic, operator screens, engineering laptops, historian data, vendor remote access, and the office network. Set the firewall to block by default and allow only the specific connections each group needs, and keep the logs.
• Take robust backups and prove they restore. Capture everything needed to rebuild a site: controller programs, HMI and SCADA applications, server images, historian data, and network device configurations. Keep a versioned copy offline and test restores on a schedule. After an incident, confirm the backup predates the compromise, or you will restore the attacker’s changes along with your own.
• Verify controller physical security. Confirm key switches are in RUN and that project files on running controllers match your known-good copies.

Then recognize the harder truth: these controls decay quietly. Firmware falls behind, firewall rules accumulate exceptions nobody remembers approving, accounts outlive the people who used them, and backups stop getting verified. Sustaining this posture requires a recurring cadence with owners and dates, and that is precisely where lean utility staff get stretched past their limits.

How Vertech Helps: Secure by Design

Vertech’s Industrial Networking & Cybersecurity (INCS) team designs SCADA systems and industrial control networks to be reliable and secure from the start, built around the same standards referenced above. That means ISA/IEC 62443-aligned assessments and network architecture, segmented networks with brokered remote access by default, firewall rules and ACLs configured as standard rather than on request, hardened remote connectivity for cellular and field sites, robust backup solutions, and unique credentials set at commissioning. The cookie-cutter integrator architectures that let attackers repeat their success across utilities are exactly what this discipline prevents.

How Vertech Helps: Secure in Operation

A hardened network on day one is not the same as a hardened network in month eighteen. Vertech’s Managed Services team provides continuous operational support for SCADA and ICS environments, closing the gap between initial design and the quiet drift that leaves systems exposed later. That includes ongoing monitoring of controller configurations and credentials for exactly the changes made in these attacks (unauthorized IP modifications, password resets, and logic alterations), regular confirmation that no device has become internet-facing, sustained segmentation and access control, tested offline backups, and scheduled firmware, rule, and account reviews handled as standard practice rather than reactive projects.

For utilities running with small staff and limited cybersecurity bandwidth, the same conditions that left many of the targeted systems exposed, Managed Services converts the guidance above into a living program. Vertech owns the recurring reviews, cleanup, validation, and restore testing that lean teams cannot sustain alone, while your operators stay focused on water quality and system performance.

The Bottom Line

The July 2026 campaign required no sophistication, only targets that were exposed, unhardened, and unwatched. The FBI and EPA have told the sector exactly what to fix. If you want help finding your exposure, engineering it out, or keeping it out for good, Vertech’s INCS and Managed Services teams do this every day for water and wastewater utilities. Reach out and we will start with an honest look at where you stand.

If you experience a similar incident, report it: contact your local FBI field office, file a complaint at ic3.gov, or reach CISA’s 24/7 Operations Center at 1-844-SAY-CISA. Source: FBI/EPA Public Service Announcement, July 30, 2026.