At the end of July, more than thirty small municipal water systems in Minnesota came under attack in what state officials described as a coordinated cyberattack.
The incidents were part of a campaign reported from July 27 onward across at least seven states. On July 30, 2026, the FBI and the Environmental Protection Agency issued joint product security advisory I-073026-PSA on attacks against water and wastewater systems.
The advisory identified Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400 series programmable logic controllers as the targeted equipment. These compact controllers manage pumps, schedule valves and run local controls that help keep water distribution networks operating.
The central weakness was direct exposure. Controllers connected to the internet could be reached through their native industrial protocols. Where a programming port was open and a default password remained in place, the barrier to entry for an attacker dropped to zero.
Researchers examining exposed devices found that many had no password or still used a default password that had never been changed. Controllers are often connected straight to the internet through a cellular modem installed by an operator or vendor and later forgotten.
Attackers changed device passwords and IP addresses, cutting off supervisory systems and, in some cases, altering ladder logic. They also reached cellular modems using SSH.
The scanning used several protocols, including ports associated with Modbus and other industrial systems, such as 502, 102 and 44818. Reporting also cited AI-written exploit scripts and the snap7 and python-snap7 libraries against Siemens S7 hardware.
The campaign did not depend on advanced exploits or unknown vulnerabilities. Its significance lies in the equipment it reached: the controls that govern pump and valve behaviour.
When that logic was changed, water pressure fell and flooding followed in some cases. Pressure loss can create conditions in which contamination enters a distribution system, and utilities have issued boil-water notices in response.
The wider scale remains a concern for the sector. CISA observed malicious activity in July 2026 against over 100 internet-exposed systems in the Water and Wastewater Systems Sector, commonly through programmable logic controllers connected directly to a cellular modem.
Also on July 30, 2026, CISA published a similar warning urging the sector to protect operational technology from PLC attacks.
The EPA has announced 11.75 million dollars through its drinking water infrastructure resilience and sustainability grant programme for ten projects across six states.
In 2024, the EPA said that more than 70% of the community water systems it had inspected since September 2023 were failing basic federal requirements for risk and emergency planning. The shortcomings included unchanged default passwords, shared staff logins and access that remained available to former employees.
Comments (0)