The short version
In late July 2026, attackers disrupted more than 30 community water systems in Minnesota over a single weekend, and similar activity reached water systems in at least seven states, including Michigan. On July 30, 2026, CISA and the FBI issued an alert describing a "significant escalation" of attacks against internet-exposed programmable logic controllers (PLCs), and the EPA held a call with hundreds of utility officials.
The method was exposure, not sophistication. Attackers reached controllers that were directly reachable on the public internet, changed passwords to lock operators out, and altered device settings. Several utilities were forced to switch to manual operation, and some issued boil-water notices as a precaution. No confirmed contamination has been reported, and state officials in Michigan said their systems kept operating safely.
Officials have not made a formal attribution. Researchers have noted patterns consistent with Iran-nexus activity, echoing the 2023 attack on the Municipal Water Authority of Aliquippa that CISA tied to the IRGC-linked CyberAv3ngers. The pattern is the same one the sector has seen for years: a controller answering on the open internet with a weak password is a controller anyone can command.
What happened
The 2026 wave was fast and broad. According to reporting corroborated by the FBI, EPA, and CISA, attacks against Minnesota water systems began over the weekend of roughly July 26 to 27, 2026, hitting more than 30 community water systems. The activity then spread, with Michigan reporting affected systems and the total reaching at least seven states. On July 30, 2026, CISA and the FBI warned publicly of a significant escalation and urged utilities to get control systems off the internet. CISA noted that organizations of all sizes were targeted, including some with mature security programs.
CISA identified the exposed equipment as internet-reachable industrial hosts, naming Rockwell Automation MicroLogix 1400 PLCs, plus Siemens and Schneider Electric devices, with thousands of each brand reachable from the public internet. Attackers changed PLC passwords to lock operators out, and in some cases modified IP addresses to disconnect devices. The FBI and EPA described operational disruption including pressure loss and flooding risk, though several utilities caught the activity and reverted to manual control before customers were affected.
This did not come out of nowhere. Three earlier incidents set the pattern:
- Municipal Water Authority of Aliquippa, Pennsylvania (November 2023). CyberAv3ngers, a persona CISA tied to Iran's IRGC, compromised an internet-exposed Unitronics Vision-series PLC still using its shipped default password, reachable on the vendor default TCP port 20256. The device regulated pressure for a booster station serving the Raccoon and Potter townships. Workers took manual control, and no service or water-quality impact was reported. CISA documented the campaign in advisory AA23-335A, and the US Treasury later sanctioned IRGC-affiliated actors.
- Veolia North America (January 2024). A ransomware incident hit the Municipal Water division's back-office systems, delaying online bill payment and exposing some personal data. Veolia said there was no evidence it affected water or wastewater treatment operations.
- American Water (October 2024). The largest regulated US water utility detected unauthorized activity on October 3, 2024, disclosed it in an SEC 8-K on October 7, and took its MyWater customer portal and billing offline. The company said its water and wastewater facilities were not affected, and restored systems within about a week.
There is also a longer-horizon concern. In the joint advisory AA24-038A (February 7, 2024), CISA, the NSA, and FBI warned that the PRC state-sponsored group Volt Typhoon had pre-positioned in IT networks across critical sectors, including water and wastewater, using living-off-the-land techniques and, in at least one case, maintaining access for years. The stated intent was to be able to move into OT and disrupt it during a crisis. That is a different threat model than the opportunistic PLC attacks, and it is why CISA has pressed operators to build and test isolation plans.
How the attack worked
The mechanism is simple, which is exactly why it keeps working. A PLC or HMI is placed on the public internet so a small operator or an integrator can reach it remotely. It answers on a known port, often with a default or weak password. An attacker scans for it, logs in, and now speaks directly to the process: read the screen, change a setpoint, change the password, or knock the device offline. There is no exploit chain to defend against because the front door is open.
Mapped to MITRE ATT&CK for ICS, the confirmed and reported behavior across these incidents looks like this:
| Tactic | Technique (ID) | What happened here |
|---|---|---|
| Initial Access | Internet Accessible Device (T0883) | PLCs and HMIs reachable directly from the public internet: Unitronics on TCP 20256 in 2023, Rockwell, Siemens, and Schneider hosts in 2026. |
| Initial Access | External Remote Services (T0822) | Remote paths into OT, including undocumented cellular modems added by vendors or integrators. |
| Lateral Movement | Default Credentials (T0812) | Devices left on shipped or weak passwords, so a successful login required no exploit. |
| Execution | Graphical User Interface (T0823) | Direct interaction with the HMI, including the defacement of the control screen at Aliquippa. |
| Persistence | Change Credential (T0892) | Attackers changed device passwords to lock legitimate operators out of their own controllers. |
| Impair Process Control | Unauthorized Command Message (T0855) | Commands issued to the controller from an unauthorized source on the network. |
| Impair Process Control | Modify Parameter (T0836) | Altered device settings, including IP address changes that disconnected PLCs. |
| Impact | Manipulation of Control (T0831) | Manipulation of pressure and pumping at affected stations. |
| Impact | Denial of Control (T0813) | Operators locked out or cut off from devices they normally manage. |
| Impact | Loss of Availability (T0826) | Utilities forced into manual operation, with pressure loss and boil-water notices in some cases. |
Why this keeps happening
Water is the hardest sector to defend for structural reasons, not negligence. Most community water systems are small utilities with no dedicated OT-security staff, run by a handful of operators who also handle everything else. The equipment is built to run for decades, so PLCs and HMIs rarely receive firmware fixes and often cannot host a security agent at all. Remote access was bolted on for convenience, sometimes by an integrator, and the quickest way to enable it was to expose the device to the internet.
Add flat networks where IT and OT share the same segment, default credentials that never got changed, and remote-access paths nobody inventoried, and you get a large, quiet attack surface. The controllers cannot defend themselves, and the standard fix, "patch the device," does not exist for most of this equipment.
How to secure it
The controls that matter are the same for every operator, regardless of budget:
- Remove OT from direct internet exposure. No PLC, HMI, or SCADA server should answer on a public IP. This single step neutralizes most of what happened in 2026.
- Kill default and shared credentials, and require identity-bound access with MFA for anyone reaching a controller, staff and vendors alike.
- Segment IT from OT so a compromised business network cannot reach the process network, and enforce zones and conduits without waiting for a full network rebuild.
- Broker and record every remote session, so vendor and operator access is inventoried, authenticated, and replayable for an incident review.
- Put an enforcement point in front of assets that cannot be patched, because most water-sector controllers never will be.
That last point is where Trout Access Gate fits, and it is worth being precise: it is a compensating control, not a silver bullet. Access Gate is an agentless, on-premise industrial proxy you place in front of the machine that cannot defend itself. It removes the controller from direct exposure, enforces identity and MFA at the network layer through OT identity, brokers and records access through secure remote access, and delivers segmentation without rewiring. The Secure Operation Twin approach means the PLC itself never changes, no agent is installed, and production does not stop.
This is the same logic behind the enduring-exception and compensating-control approach for OT that cannot meet a control as written, applied to a Unitronics or MicroLogix PLC that will never get MFA of its own. For the wider design pattern, see Zero Trust for OT and the water and wastewater hub. In the US, this maps to Safe Drinking Water Act Section 1433 and AWIA resilience obligations, plus EPA sanitary survey expectations, not NERC CIP, which governs electricity.
What to do this week
- Find every OT device on the public internet. Search your public IP ranges and known vendor ports; assume anything that answers is already being scanned.
- Pull those devices off the internet and route access through a gateway or proxy instead of a direct connection.
- Change every default and shared password on PLCs, HMIs, and SCADA servers, and turn on MFA for remote access.
- Inventory remote-access paths, including cellular modems and integrator connections you did not install yourself.
- Confirm IT and OT are segmented, so a phishing hit on the office network cannot reach the process network.
- Enable and back up logging, so you can prove what happened and restore known-good device settings after tampering.
- Review CISA advisory AA23-335A and your AWIA risk and resilience assessment, and align this week's fixes to them.