The Cybersecurity and Infrastructure Security Agency (CISA) reported that more than 100 internet-exposed systems within the water and wastewater sector were targeted by malicious cyber activity during July 2026. The disclosure is included in new guidance focused on reducing internet exposure across critical infrastructure and represents the first time the agency has assigned a number to a campaign that has unfolded for weeks across multiple states.
CISA’s guidance indicates that attackers most commonly gained access through programmable logic controllers (PLCs) that were connected directly to cellular modems. PLCs are industrial devices used to control physical equipment such as pumps and valves, making them a critical point of vulnerability when left exposed to the open internet. Direct connectivity without proper network segmentation or secure access controls increases the likelihood of compromise.
Utilities confirmed as affected to date are located in several states, including Michigan, Minnesota, Georgia, South Dakota, New Jersey, and Alabama, and reports suggest the true number of impacted states could be higher. Most of the affected facilities serve small or rural communities, where limited IT resources and aging infrastructure can complicate security efforts. So far, reported impacts have centered on operational disruptions rather than confirmed harm to water supply or water quality.
While CISA has not formally attributed the campaign to any specific actor, previous advisories from the agency have pointed to Iran-linked groups as a likely source amid heightened regional tensions. The current notice does not change that assessment but emphasizes immediate risk reduction steps for utilities regardless of attribution.
In response to the incidents, CISA is urging water and wastewater utilities to audit which assets truly require internet connectivity, move remote access behind secure gateways or virtual private networks rather than exposing PLCs directly, and strengthen authentication to withstand brute-force attempts. The agency continues to offer free vulnerability scanning and technical support to help operators identify and close exposures before additional incidents occur.