CISA: Over 100 Internet-Exposed Water Systems Targeted in July Cyberattacks

CISA disclosed that over 100 internet-exposed water systems were targeted in July cyberattacks, offering the agency's first public count for a campaign that had previously been described only through scattered state-level reports. The agency said the activity hit systems in the Water and Wastewater Systems (WWS) Sector, most commonly programmable logic controllers (PLCs) connected directly to a cellular modem rather than routed through a utility's managed IT network.

The number was published as part of updated CISA guidance aimed at helping critical infrastructure organizations reduce their internet attack surface. Until this release, federal agencies had not quantified how many systems were hit in the recent wave of attacks on water and wastewater utilities, according to SecurityWeek.

The scale disclosed by CISA turns a series of individual incidents into evidence of a systemic exposure problem across the water sector. Matt Hartman, chief strategy officer at Merlin Group, said the fact that more than 100 internet-exposed systems were targeted in a single month shows this is a systemic risk rather than isolated incidents, since much of the OT in water utilities was never designed to sit directly on the internet.

For managed service providers and integrators supporting water utilities, the exposure risk extends beyond the utility itself. SC World reported that water-sector supplier Micro-Comm had roughly 850,000 files leaked around the same time CISA's guidance was published, with the ransomware group Barracuda claiming responsibility. Kevin Surace, CEO of TokenCore, said the Micro-Comm incident shows that protecting the utility is only half the problem, since attackers can also target the companies that manufacture, configure, and remotely support utility technology.

Water and wastewater utilities in at least 12 US states have been affected, according to CISA, though the full list has not been made public. Minnesota, Michigan, South Dakota, Georgia, New Jersey, and Alabama have each confirmed they were targeted, per SecurityWeek. TechCrunch reported the affected utilities span Michigan, Minnesota, and at least five other states, with many of the hit communities in rural or isolated areas where infrastructure disruption can affect a large population.

• PLCs made by Rockwell Automation, Schneider Electric, and Siemens have been targeted in recent weeks.
• CISA previously warned of Iran-linked attacks on ICS from these three manufacturers.
• Water-sector vendor Micro-Comm was separately hit by a ransomware group calling itself Barracuda.

A PLC connected directly to a cellular modem is, by CISA's account, the common entry point in the July campaign: it bypasses a utility's firewall and internal network monitoring entirely, exposing the controller straight to the public internet. TechCrunch reported that some intrusions let attackers modify affected PLCs to disable shutdown processes and alarms, which could create unsafe conditions without alerting the operator.

Denis Calderone, chief technology officer at Suzu Labs, told SC World that the sophistication of these intrusions has grown sharply since 2023, when the CyberAv3ngers group mainly changed default passwords on Unitronics PLCs and posted political messages on HMI screens. By July 2026, Calderone said, CISA confirmed actors were exfiltrating PLC project files using vendors' own engineering software and modifying add-on instructions while keeping operator displays looking normal. A separate five-agency advisory said attackers are also using AI tools to generate exploitation scripts against Siemens S7 controllers from public vulnerability information.

US officials have not issued a formal attribution, but reports citing senior American officials say intelligence agencies believe Iran is likely behind the largely opportunistic attacks, possibly in response to the US and Israel-led war against Iran, according to TechCrunch.

CISA's guidance tells organizations to first identify every internet-accessible system through internal inventories and external scanning, then determine which exposures are actually necessary for operations and remove or restrict the rest. For systems that must stay online, the agency recommends changing default passwords, applying available security updates, routing remote access through secure gateways or jump hosts, enforcing multifactor authentication, and continuously monitoring traffic.

• Route remote access through a secure gateway, firewall, or VPN instead of connecting directly to a PLC, HMI, or RTU, per CISA.
• Change default credentials and apply available patches on internet-facing OT.
• Enforce MFA on all remote access paths into control systems.
• Reassess network and third-party connections regularly as exposure changes.

Danny Jenkins, CEO of ThreatLocker, told SC World that utilities should disconnect PLCs from the public internet as quickly as possible and move to alternatives like private lines or satellite communications where a cellular or public internet connection is not required.

CISA's guidance follows earlier warnings about Iran-linked activity against ICS made by Siemens, Schneider Electric, and Rockwell Automation, and about AI-assisted exploitation attempts against Siemens PLCs. Watch for whether CISA or state agencies release a full list of affected utilities, whether patches or firmware mitigations follow for the targeted PLC lines, and whether the Micro-Comm breach investigation surfaces further downstream utility exposure.

No significant disruption to water or wastewater supply has been reported so far, but the disclosed scale, combined with a separate ransomware breach at a water-sector vendor, has renewed pressure on Congress and CISA to accelerate mandatory OT exposure reduction across the sector.

CISA confirmed over 100 internet-exposed water and wastewater systems were targeted in July 2026, mostly through PLCs reachable via cellular modems, with no significant disruption to water supply reported.

Security: CISA's advisory shows the water sector attack surface extends beyond individual utilities to third-party vendors, as illustrated by the nearly 850,000 files leaked in the Micro-Comm breach, per SC World's report.

Privacy: According to SC World, an expert speculated that files leaked in the Micro-Comm breach could include product diagrams, system architecture documents, and customer-specific configurations, rather than personal consumer data.

CISA disclosed that more than 100 internet-exposed water and wastewater systems were targeted in July 2026, largely through PLCs connected directly to cellular modems, and issued guidance to cut OT internet exposure.