The Cybersecurity and Infrastructure Security Agency reported that more than 100 internet‑exposed systems in the water and wastewater sector were targeted by malicious cyber activity during July 2026. The disclosure appears in new guidance focused on reducing internet exposure across critical infrastructure and represents the first time the scope of the campaign has been quantified after weeks of incidents across multiple states. According to the summary accompanying the guidance, intrusions resulted in lockouts and outages at affected facilities. The agency’s message centers on reducing exposure of operational technology to the open internet.
The guidance notes that attackers most commonly gained access through programmable logic controllers connected directly to cellular modems. These industrial devices control physical processes such as pumps and valves, making them a key point of risk when reachable from the public internet. Leaving such equipment exposed increases the likelihood of brute‑force attempts and unauthorized remote manipulation. The advisory frames removal of direct exposure as a primary risk‑reduction step.
Reported impacts span utilities in Michigan, Minnesota, Georgia, South Dakota, New Jersey, and Alabama, with indications that the true number of affected states may be higher. Many of the facilities involved serve small or rural communities, where constrained IT staffing and aging infrastructure can make securing legacy operational technology more difficult. To date, the incidents have produced operational disruptions, and there is no confirmed harm to water supply or quality. The campaign’s breadth has heightened attention on segmentation and access controls for control systems.
CISA has not formally attributed the activity to a specific actor. However, previous advisories from the agency have pointed to Iran‑linked groups as a likely source amid elevated regional tensions. The current document focuses on exposure reduction rather than attribution, emphasizing steps operators can take immediately to mitigate risk.
Recommended actions include auditing which assets truly require internet connectivity and removing public exposure wherever possible. The agency advises placing any necessary remote access behind secure gateways or virtual private networks rather than exposing controllers directly, and strengthening authentication to withstand brute‑force attempts. CISA is also continuing to offer free vulnerability scanning and technical assistance to help utilities identify and remediate exposures before further incidents occur. The guidance is intended to support near‑term hardening while longer‑term modernization of legacy systems proceeds.