100+ Water Systems Targeted in July OT Cyberattacks

For OT and ICS security teams, CISA's confirmation that more than 100 water systems were targeted in July 2026 is a wake-up call: internet-exposed PLCs on cellular modems remain a trivially discoverable entry point. The agency's guidance to inventory and shrink the internet attack surface, replace default credentials, and enforce MFA for remote access should be treated as an operational checklist, not just another advisory.

On August 26, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) publicly confirmed that it observed malicious cyber activity targeting more than 100 internet-exposed systems in the Water and Wastewater Systems (WWS) Sector during July 2026. The disclosure, embedded in updated guidance for reducing the internet exposure of operational technology, offers the first federal quantification of the recent wave of attacks against water and wastewater utilities. CISA singled out programmable logic controllers (PLCs) connected directly to cellular modems as the common attack vector. These devices—often deployed with default credentials and without network segmentation—provide a direct bridge from the open internet to physical processes such as pumps, valves, and chemical dosing. The agency is urging organizations to aggressively shrink that attack surface by identifying all internet-accessible systems, eliminating unnecessary exposures, and securing those that must remain reachable.

“

The affected devices included PLCs from Rockwell Automation, Schneider Electric, and, more recently, Siemens.

The attacks have been linked by senior U.S. officials to Iranian threat actors and described as largely opportunistic, likely reprisal activity tied to U.S.-Israel military actions against Iran. While the intrusions did not cause significant disruption to water or wastewater supplies, they produced outages and operational interruptions as incident responders investigated affected facilities. CISA has previously noted that hackers were able to modify PLCs to disable shutdown processes and alarms, which could create unsafe operating conditions without alerting operators. The affected devices included PLCs from Rockwell Automation, Schneider Electric, and, more recently, Siemens. CISA also reported that the attackers relied in part on AI tools that use public information to develop scripts capable of targeting vulnerable Siemens PLCs. This use of AI-generated exploitation code is a notable escalation: it lowers the skill barrier for targeting industrial control systems and accelerates the speed at which public vulnerabilities can be weaponized.

At least 12 states have been affected, with Minnesota, Michigan, South Dakota, Georgia, New Jersey, and Alabama among those confirming targeted systems. Many of the affected communities are rural or isolated, where a water system outage can ripple across a substantial population and where local cybersecurity resources are often scarce. This geography matters: small utilities rarely maintain dedicated OT security staff, and their reliance on remote cellular connections for operational convenience makes them particularly exposed. CISA's guidance—recommending internal inventories, external scanning, elimination of unneeded internet-facing assets, changing default passwords, applying security updates, routing remote access through secure gateways or jump hosts, and enforcing multifactor authentication—is designed to be actionable for such resource-constrained operators. The challenge is not technical sophistication but operational discipline and sustained funding.