The US Cybersecurity and Infrastructure Security Agency (CISA) has disclosed that more than 100 internet‑exposed systems within the water and wastewater sector were targeted by malicious cyber activity during July 2026. The disclosure appears in new guidance aimed at reducing internet exposure across critical infrastructure and represents the first time the scope of the ongoing campaign has been quantified. Incidents have unfolded over several weeks across multiple US states, causing operational disruptions such as lockouts and localized outages at some facilities. To date, there is no confirmed harm to water supply or water quality.
According to the guidance, attackers most commonly gained access through programmable logic controllers (PLCs) that were connected directly to cellular modems. PLCs are industrial devices that control physical processes, including pumps and valves, and become high‑risk when reachable from the open internet. Exposing these systems can enable unauthorized changes, operator lockouts, or service interruptions that hinder normal plant operations.
Reported impacts span several states, including Michigan, Minnesota, Georgia, South Dakota, New Jersey, and Alabama, though the true number may be higher as additional reports are assessed. Many of the affected utilities serve small or rural communities, where limited IT staffing and aging infrastructure can complicate security hardening and incident response. In these environments, direct exposure of control equipment can persist longer, increasing the likelihood of disruption.
CISA has not formally attributed the campaign to a specific actor. However, previous advisories from the agency have pointed to Iran‑linked groups as a likely source amid heightened regional tensions. The latest notice quantifies exposures and impacts but does not assign responsibility.
In response, CISA is urging water utilities to audit which assets truly require internet connectivity, move remote access behind secure gateways or virtual private networks rather than exposing PLCs directly, and strengthen authentication to withstand brute‑force attempts. The agency continues to offer free vulnerability scanning and technical assistance to help operators identify and close these exposures before further incidents occur. These actions are intended to reduce direct exposure of industrial control systems and improve resilience across the sector.
