The US Cybersecurity and Infrastructure Security Agency (CISA) disclosed that more than 100 internet-exposed systems across the water and wastewater sector were targeted by malicious cyber activity during July 2026. The figure appears in new guidance focused on reducing internet exposure within critical infrastructure and marks the first time the scale of the ongoing campaign has been quantified publicly. The advisory follows reports of intrusions that caused lockouts and outages at facilities in multiple states. CISA’s publication is intended to help utilities understand the nature of the exposures and prioritize remediation.
According to the guidance, the most common intrusion path involved programmable logic controllers (PLCs) that were connected directly to cellular modems. PLCs are industrial devices used to control physical equipment such as pumps and valves, so exposing them to the open internet can create significant operational risk. Direct connectivity can allow attackers to probe, brute-force, or otherwise manipulate controller behavior. CISA warns that minimizing or eliminating direct internet pathways to such devices is a foundational protection step.
The campaign has affected utilities in several states, including Michigan, Minnesota, Georgia, South Dakota, New Jersey, and Alabama. Reports suggest the true number of impacted states could be higher. Many of the affected facilities serve small or rural communities, where limited IT resources and aging infrastructure can make systems more challenging to secure. To date, the incidents have caused operational disruptions rather than confirmed harm to water supply or quality.
CISA has not formally attributed the campaign to a specific actor. However, previous advisories from the agency have pointed to Iran-linked groups as a likely source amid heightened regional tensions. The current guidance does not change attribution status but reiterates the observed techniques and exposure conditions exploited in the incidents.
In response to the findings, CISA is urging water utilities to audit which assets truly require internet connectivity and to remove unnecessary exposure. The agency recommends placing remote access behind secure gateways or virtual private networks rather than exposing PLCs directly, and strengthening authentication controls to resist brute-force attempts. CISA is also continuing to offer free vulnerability scanning and technical support to help operators identify and remediate exposures. The goal is to close publicly reachable pathways into operational technology environments and reduce the likelihood of further incidents.