Key Takeaways
- Water and wastewater utilities in at least seven states have reported cyber incidents to the FBI since July 27, 2026, with some of that activity degrading water operations. The FBI and EPA have not named the affected states.
- The warning follows a coordinated attack on at least 30 Minnesota water facilities on July 26 to 27.
- CISA said the activity has resulted in boil water notices and sustained manual operations, though it did not identify affected locations.
- Wisconsin's Department of Natural Resources issued a statewide alert to utilities describing malicious activity targeting programmable logic controllers (PLCs) and urging immediate action.
- The attacks come three months into joint advisory AA26-097A, which documents state-affiliated exploitation of internet-facing PLCs. The U.S. government has not connected the two, and the investigation remains active.
At least seven states in the U.S. have seen a sweep of cyberattacks in the last week. The Federal Bureau of Investigation (FBI) and Environmental Protection Agency (EPA) have issued a joint public service announcement (PSA) and the Cybersecurity and Infrastructure Security Agency (CISA) a separate advisory, both urging operators to disconnect exposed controllers from the internet.
The advisories cover cyberattacks documented since July 27, 2026. The attacks centered around operational technology (OT) devices, namely the MicroLogix 1100 and 1400 series, which are well-known programmable logic controllers (PLCs).
Minnesota IT Services (MNIT) reported at least 30 municipal water facilities were targeted July 26 to 27, and Wisconsin's Department of Natural Resources issued a statewide alert the same week, though state officials there reported no confirmed compromises.
PLCs are used in virtually any industry that requires automated control, machinery, or process regulation. Designed for reliability, they are observed to run insecure protocols never meant to be exposed. Past honeypot testing has shown these exposed systems can be found and attacked within hours. A previous TrendAI™ research analyzes how these exposed control systems are a risk.
The attack
The method here is simple: attackers are breaking into PLCs that are exposed online and weakly secured.
Once they have access to these PLCs, they begin changing IP addresses and setting passwords of their own, turning on and setting passwords, resulting in the loss of monitoring and in some cases, control functionalities. In at least one case the actors went further than configuration changes and altered the controller project files themselves. The FBI and EPA say the organization noticed only when its ladder logic stopped matching across several sites.
Across several victims, there appeared to be notable similarities in network setup by their respective third-party providers. This may have contributed to the actors finding success across multiple targets, as vulnerable network and hardware setups exist across several entities.
Exposure in the water sector is a longstanding issue. TrendAI™ mapped water and energy control system interfaces reachable from the open internet in 2018, every one of them at a small or mid-sized organization. CISA and the EPA flagged the same lockout technique in December 2024.
Operational impact
The FBI states that the most notable effects have been loss of pressure and flooding. This is a major problem, as the FBI notes that a drop in pressure can draw untreated groundwater into the distribution network. No contamination has been reported at any affected facility.
Analysts have described this as among the most serious attacks on the U.S. water system in years, with the scale and coordination seen in Minnesota called unprecedented for the sector. CISA, the FBI, and the EPA have spent the past week working with affected entities to contain the damage and confirm that drinking water remains safe.
Security precautions to mitigate critical infrastructure attacks
CISA notes that these attacks are going after water entities of all sizes. An important takeaway here is that targeting extends to cellular modems, often fitted by an operator, vendor, or system integrator and often absent from the asset register a routine attack surface scan works from. Even organizations with mature cybersecurity measures are therefore advised to review and validate their external connections.
Defending against these attacks is largely a matter of configuration and access control. The measures below combine what the FBI, EPA, and CISA have advised with the steps that matter most for water and wastewater operators specifically.
Close the exposure
- Take controllers off the public internet. Route all remote access through a secure gateway or jump host with multifactor authentication (MFA), including any cellular modems used for field connectivity, which should be authenticated and logged.
- Set complex, unique device passwords and restrict who can reach the controller. Passwords should combine letters, numbers, and symbols and should not be reused across devices. Use firewall rules or an access control list (ACL) to permit only authorized communication between expected control system devices.
- Set controllers to RUN, only move to PROGRAM or REMOTE during active supervised maintenance windows. On the controllers covered in our earlier analysis, a hardware key switch in RUN can still be overridden by a network command. On the MicroLogix 1100 and 1400, there is no key switch to override. The mode is set from the built-in LCD keypad or in software. Either way, mode selection works best as one layer alongside removing internet exposure and gating remote access.
- Enable programming protection on the controller. Rockwell operators should work through the current SD1771 guidance, which AA26-097A points to directly; Siemens operators should configure protection in TIA Portal.
Check for compromise
- Query your logs for the AA26-097A indicators. Search firewall, intrusion detection, and network monitoring logs for the advisory's IP addresses, with attention to overseas hosting providers. Prioritize ports 44818 and 2222 (EtherNet/IP) and 22 (SSH) for Rockwell estates. The July 22 revision refreshed the indicator set, so a list pulled in April is now stale.
- Compare running project files against a known-good baseline. One victim in this campaign found its project files altered. Reusable code modules deserve particular attention, since a single tampered block carries into every process that calls it.
Limit the damage
- Keep offline backups and test the restores. Store backups on secured physical media, separate from the network the PLC lives on, and confirm a backup is clean before restoring it.
- Practice and maintain the ability to operate manually. Reverting to manual control is what allowed affected utilities in this campaign to keep running. Fail-safe mechanisms, islanding capability, and standby systems should be tested routinely rather than assumed.
- Plan for end-of-life replacements. Once a manufacturer stops supporting a device, it stops receiving security patches, and unsupported hardware is routinely targeted. Keep a rolling 12-month end-of-life (EOL) forecast reviewed with asset owners and procurement, and apply compensating controls with firm decommission dates where replacement has to wait.
Notable ongoing developments
- The U.S. government has not publicly named an entity behind these attacks, and the affected states outside Minnesota have not been identified.
- These attacks follow a series of earlier advisories. Joint advisory AA26-097A (issued by the FBI, CISA, the NSA, the EPA, the Department of Energy, and U.S. Cyber Command on April 7, and revised on July 22 with the Treasury Department added as a coauthor) warns that state-affiliated actors have been actively exploiting internet-facing PLCs across U.S. government services, water systems, and energy infrastructure since at least March 2026. The July revision widened the observed scope beyond Rockwell to include Schneider Electric and Siemens devices. Our analysis of that update covers what else changed.
- The Minnesota attacks began four days after that revision. Whether the two are connected is, for now, an open question.
Conclusion
Cybersecurity for critical infrastructure must extend beyond compliance to continuous operational resilience. Organizations that combine strong governance, secure architectures, and AI-driven security operations will be best positioned to detect threats earlier, reduce operational risk, and protect the essential services their communities depend on. The cost of proactively securing operational technology is significantly lower than the operational, financial, and impact on public trust when recovering from a successful cyberattack.
CISA's Secure by Demand guidance presses manufacturers directly: ship products that don't expose administrative interfaces to the internet by default, support MFA (including phishing-resistant methods), and stop charging extra fees for the basic security features that a product needs to run safely. That last point carries particular weight in a sector made up largely of small municipal utilities running thin budgets and aging equipment. Organizations buying industrial equipment should make these firm conditions of purchase and get them written into the contract.
Meanwhile, what operators keep is the work that never finishes. When the intrusion method is an exposed device and a changed password, a point-in-time assessment reveals almost nothing about whether an environment stays protected next month. These controls need to be validated continuously, rather than checked once. Knowing what's reachable from the internet into the OT environment, and confirming that segmentation is enforced rather than assumed, is the whole difference between reading the advisory and acting on it.
TrendAI™ Research will update this blog in the event of new findings.