Critical Infrastructure Security Crisis: CISA Reveals Over 100 Internet-Exposed Water & Energy Facilities Targeted in Cyberattacks
Executive Summary
In a comprehensive cybersecurity advisory published on August 26–27, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) publicly revealed that more than 100 internet-exposed systems across the Water and Wastewater Systems (WWS) Sector and energy utilities were actively targeted in coordinated nation-state cyberattacks during July and August 2026. Affecting municipal utilities in at least 12 U.S. states (including Minnesota, Michigan, South Dakota, Georgia, New Jersey, and Alabama), threat actors exploited Programmable Logic Controllers (PLCs) connected directly to the public internet via cellular modems. Intruders manipulated controller project files, altered chemical dosing thresholds, and disabled critical safety shutdown logic, prompting federal emergency declarations and bipartisan Senate legislation.
Technical Breakdown of the Industrial Control Intrusions
The advisory details how threat actors leverage basic architectural exposures to achieve operational disruption:
1. Cellular Modem Exposure & Protocol Scanning
The primary initial access vector bypassed enterprise IT firewalls entirely through remote telemetry connections:
* Direct Cellular Modem Connectivity: Small municipal water facilities and remote pumping stations frequently deploy cellular modems (e.g., InHand, Cradlepoint, Sierra Wireless) to enable remote monitoring by small staff. In over 100 confirmed cases, these modems exposed the industrial controllers directly to public IP addresses without VPN encapsulation or firewall filtering.
* Port Reconnaissance on Industrial Protocols: Threat actors scanned public IP blocks for open industrial automation ports: EtherNet/IP (port 44818), Modbus TCP (port 502), Siemens S7 (port 102), and Unitronics PCOM (port 20256).
* Factory-Default Credential Abuse: Attackers logged into controller web interfaces and programming sessions using un-rotated factory default passwords (e.g., admin:admin, 1111), requiring no zero-day exploits or custom malware.
2. Ladder Logic Modification & Alarm Suppression
Once authenticated, the attackers manipulated physical process controls:
* Overwriting Safety Interlocks: Threat actors uploaded modified ladder logic project files that altered pump cycle intervals, chemical treatment setpoints (such as chlorine dosing), and tank water levels.
* Alarm Suppression: Attackers disabled telemetry alarms, preventing alert notifications from reaching operator dashboards when physical parameters exceeded safe operating thresholds.
* Operator Lockouts: In multiple facilities, attackers changed administrative passwords and altered controller IP configurations, locking municipal operators out of their own SCADA networks and forcing manual emergency failovers.
Incident Parameter
Details
Target Sector
Water and Wastewater Systems (WWS) & Distributed Energy Utilities
Impacted Facilities
100+ Documented Internet-Exposed Systems across 12+ U.S. States
Targeted Hardware
Rockwell Automation (MicroLogix), Siemens (S7-1200), Schneider Electric, Unitronics
Initial Access
Cellular Modems Connected Directly to Internet without Firewall/VPN; Default Passwords
Threat Attribution
Iranian State-Sponsored Cyber Units / IRGC Cyber-Electronic Command
Regulatory Response
White House National Emergency Declaration & Senate Water Cyber Shield Act
The Systemic Vulnerability of Distributed Operational Technology
The disclosure underscores the severe security divide between major metropolitan utilities and small municipal operators. While major utilities maintain segregated industrial demilitarized zones (IDMZs), smaller regional facilities operate on constrained budgets and rely on public cellular connections for convenience. When critical water treatment controllers are exposed to the open internet, geopolitical adversaries can launch automated scanning scripts that turn municipal utilities into accessible targets.
Physical infrastructure operators must recognize that internet connectivity without strict cryptographic segmentation transforms physical machinery into remote cyber targets.
Recommendations and Mitigations
Water utilities, wastewater authorities, and critical infrastructure operators should immediately enforce the following defensive mandates:
1. Disconnect PLCs from Public Cellular Modems: Immediately remove all direct cellular modem connections to PLCs and RTUs; route all remote telemetry through encrypted IPsec/WireGuard VPNs with phishing-resistant MFA.
2. Change All Factory-Default Passwords: Audit and rotate default passwords across all SCADA human-machine interfaces (HMIs), PLCs, cellular modems, and managed network switches.
3. Turn Controller Key-Switches to Physical "RUN" Mode: Physically switch PLC hardware key-switches to RUN mode (disabling REMOTE or PROGRAM mode) to prevent unauthorized remote ladder logic modifications over the network.
4. Implement Regular Offline Configuration Backups: Maintain verified, air-gapped backups of all PLC project files and logic configurations to enable rapid manual recovery during operational disruptions.