FBI Warns: Hackers Breaching US Water Utility Controllers
FBI and EPA Warn: Hackers Are Breaking Into US Water Utility Controllers Across 12 States
The FBI and EPA issued a joint advisory warning that hackers are actively breaking into internet-connected industrial controllers at water and wastewater utilities across at least 12 US states, in some cases causing pressure loss and flooding by locking operators out of their own systems. The attackers are targeting Rockwell Automation and Allen-Bradley MicroLogix programmable logic controllers (PLCs) that were left directly exposed to the internet, remotely changing their IP addresses and passwords to cut off monitoring and control. A follow-up security scan found more than 4,400 of these same controllers still sitting exposed online worldwide, including inside the very cities already hit.
This isn't a hypothetical vulnerability disclosure. It's an active, ongoing campaign, and the pattern behind it is one that shows up far beyond water utilities.
What Actually Happened
Since July 27, 2026, water and wastewater utilities across at least 12 states, including Minnesota, Michigan, South Dakota, and Georgia, have reported operational disruptions tied to unauthorized access of their industrial control systems. In Minnesota alone, more than 30 community water systems, including Plymouth, South St. Paul, Maple Plain, and Braham, were affected over a single weekend. Michigan reported nine affected systems, and South Dakota reported at least one impacted wastewater lift station.
The FBI's public service announcement, issued jointly with the EPA on July 30, describes a consistent pattern: attackers remotely accessed internet-facing PLCs, specifically Rockwell Automation/Allen-Bradley's MicroLogix 1100 and 1400 series, then changed the devices' IP addresses and passwords. That locks the utility's own staff out of monitoring and controlling the equipment, in some cases resulting in real physical effects like water pressure loss and flooding. At least one affected organization discovered its PLC logic itself had been altered, identified through discrepancies in the underlying ladder logic across multiple sites.
How the Attackers Got In
This wasn't a sophisticated zero-day exploit. The core issue is far more basic and far more common: these controllers were reachable directly from the public internet in the first place. A follow-up scan by security firm Forescout, run August 3, found 4,407 Rockwell Automation controllers exposed online globally, 2,844 of them in the United States, with 22 located specifically in cities already confirmed to be affected. Of those exposed devices, MicroLogix 1400 controllers made up roughly half, followed by CompactLogix 1769 controllers at 22%, with MicroLogix 1100 and ControlLogix 5590 models each accounting for about 8%.
Notably, Forescout's analysis found that the reported effects didn't require exploiting a software vulnerability at all. Simply having direct network access to an exposed, weakly secured controller was enough to change its configuration. That distinction matters: this isn't primarily a patching problem, it's an exposure and access-control problem.
Why This Keeps Happening in Industrial Environments
Operational technology (OT) systems like water treatment PLCs were historically designed assuming they'd never be reachable from the public internet. As utilities modernized and added remote monitoring capabilities, many controllers ended up directly internet-facing, sometimes without the organization fully realizing it, especially at smaller utilities without dedicated OT security staff. Combine that exposure with default or weak credentials, and a controller that should require sophisticated access becomes reachable by anyone who finds it on a basic internet scan.
This pattern isn't unique to water utilities. The same exposure risk applies to manufacturing floors, energy infrastructure, building management systems, and any industrial environment running legacy PLCs that were never designed with internet connectivity, and its risks, in mind.
What the FBI and EPA Recommend
The official guidance from the advisory is direct and immediately actionable:
Remove PLCs from direct internet exposure. Controllers should sit behind a secure gateway and properly configured firewall, never reachable directly from the public internet.
Set strong, unique passwords on every device, replacing any default or shared credentials.
Use access control lists (ACLs) to permit only authorized communication between expected control system devices, blocking everything else by default.
Maintain current offline backups of PLC logic, since recovering from a compromised controller depends on having a clean, verified copy of the original configuration to restore.
Audit your environment for internet-facing OT devices now, rather than assuming your network segmentation is intact. Forescout's scan found thousands of exposed devices despite years of prior warnings about exactly this risk.
The Broader Lesson for Industrial and Compliance Teams
The most important detail in this whole advisory isn't the specific vendor or the specific vulnerability, it's that basic exposure and credential hygiene, not advanced exploitation, was enough to disrupt physical infrastructure. For any organization running OT or industrial control systems, this is a direct prompt to audit what's actually reachable from the internet today, not what your network diagram from three years ago says should be reachable. Compliance frameworks increasingly expect documented network segmentation and access control for OT environments specifically, and advisories like this one tend to accelerate audits and enforcement in the sectors affected.
Frequently Asked Questions
What controllers are affected by this attack? The FBI and EPA advisory specifically names Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 series programmable logic controllers, though the agencies noted that similar risks apply to other branded PLCs with the same exposure pattern.
Did the hackers exploit a specific vulnerability? Not necessarily. Security researchers found that the reported effects could be achieved simply by accessing an internet-exposed, weakly secured controller directly, without exploiting a software vulnerability at all. This points to an exposure and credential-security problem rather than a patching problem.
How many water systems were affected? Utilities in at least 12 US states reported incidents since July 27, 2026, including more than 30 community water systems in Minnesota alone during a single weekend, nine systems in Michigan, and at least one wastewater facility in South Dakota.
Was drinking water contaminated? Officials stated there was no indication that drinking water itself was contaminated, though the attacks did cause operational effects including water pressure loss and flooding at some facilities.
What should organizations do right now? Audit your network for any industrial control system devices directly reachable from the public internet, move them behind a secure gateway and firewall, replace default or weak passwords immediately, restrict device-to-device communication with access control lists, and maintain verified offline backups of controller logic in case recovery is needed.
Is this only a water utility problem? No. The underlying issue, internet-exposed industrial controllers with weak or default credentials, applies broadly across manufacturing, energy, and any sector running legacy operational technology. Water utilities are the confirmed victims in this specific campaign, but the exposure pattern is common well beyond that sector.
Based on the FBI/EPA joint Public Service Announcement (I-073026-PSA) issued July 30, 2026, and security research from Forescout's Vedere Labs published August 5, 2026. Details may be updated as federal agencies release further information; consult the official FBI and CISA advisories directly for the most current guidance.
Suggested Images and Alt Text
Image 1: Hero image, industrial control panel/water treatment facility Alt text: Water treatment facility industrial control system panel with programmable logic controllers Caption: The FBI and EPA say hackers are targeting exposed industrial controllers at water utilities across at least 12 states.
Image 2: Network security/firewall diagram Alt text: Diagram showing a secured industrial control system behind a firewall and gateway versus an exposed direct internet connection Caption: Removing PLCs from direct internet exposure is the FBI and EPA's top recommendation.
Image 3: Map or graphic showing affected US states Alt text: Map showing US states affected by water utility cyberattacks including Minnesota, Michigan, South Dakota, and Georgia Caption: Utilities in at least 12 states have reported incidents since July 27, 2026.
Image 4: Cybersecurity analyst reviewing OT network monitoring dashboard Alt text: Industrial cybersecurity analyst reviewing operational technology network monitoring dashboard Caption: Auditing which industrial control devices are internet-facing is the first step toward closing this exposure.
Comments