CISA Reports July Cyberattacks On Water Utilities

The US Cybersecurity and Infrastructure Security Agency (CISA) has reported that more than 100 internet-exposed systems within the water and wastewater sector were targeted by malicious cyber activity during July 2026. The disclosure appears in new agency guidance focused on reducing internet exposure across critical infrastructure and represents the first time CISA has quantified the scope of a campaign that has unfolded for weeks across multiple US states. According to the report, affected facilities experienced account lockouts and outages. The announcement aims to prompt utilities to reassess how and where their operational technology is reachable from the public internet.

CISA’s guidance notes that attackers most commonly gained access through programmable logic controllers (PLCs) that were directly reachable via cellular modems. PLCs are industrial devices that control equipment such as pumps and valves, making them a critical point of vulnerability when exposed online. Direct connectivity allows adversaries to attempt brute-force logins or exploit weak configurations, increasing the risk of disruption to core plant processes.

The campaign has impacted utilities in several states, including Michigan, Minnesota, Georgia, South Dakota, New Jersey, and Alabama, and the true number of affected states may be higher. Many of the facilities serve small or rural communities, where limited IT staffing and aging infrastructure can complicate security improvements. To date, reported effects have been operational disruptions rather than confirmed harm to water supply or quality.

While no formal attribution has been issued for this activity, CISA’s prior advisories have referenced Iran-linked groups as a likely source amid heightened regional tensions. The current notice maintains a focus on mitigation steps rather than attribution, emphasizing actions water operators can take immediately to reduce exposure and resilience gaps.

In response to the incidents, CISA urges water utilities to audit which assets truly require internet connectivity, and to move remote access behind secure gateways or virtual private networks instead of exposing PLCs directly. The guidance also recommends strengthening authentication to withstand brute-force attempts, reducing default or shared credentials, and tightening access controls.

To support operators, the agency continues to offer free vulnerability scanning and technical assistance to help identify and remediate exposures. The overall message is to minimize direct internet reachability of operational technology and adopt layered defenses so that similar campaigns cannot easily disrupt plant operations in the future.