Recent cyberattacks on US water infrastructure are believed to part of a nation-state programme by Iran.
Several towns in Minnesota and Michigan last week reported that the computers used to monitor and adjust water quality had been hit by a malware attack.
The Federal Bureau of Investigation (FBI) and Environmental Protection Agency (EPA) have issued a Public Service Announcement (PSA) to warn other critical infrastructure asset owners and operators that malicious cyber actors (MCAs) are conducting cyberattacks targeting operational technology (OT) devices.
The devices most at risk have been identified as Rockwell Automation/Allen-Bradley programmable logic controllers (PLCs), specifically MicroLogix 1100 and 1400 series.
The FBI reports that, since 27 July 2026, water and wastewater sector (WWS) utility companies in at least seven states have reported incidents to the FBI, and some of that activity degraded water operations.
After remotely accessing Internet-facing devices, the actors changed the IP addresses and passwords, resulting in a loss of monitoring and control functionality.
To reduce the risk of compromise, the FBI and EPA recommend removing PLCs from direct Internet exposure via secure gateway and firewalls, setting up strong, unique passwords, and utilising an access control list (ACL) to allow only authorized communication between expected control system devices.
The Cybersecurity and Infrastructure Security Agency is also urging critical infrastructure owners, operators and integrators to remove publicly exposed PLCs and other operational technology (OT) from the Internet as soon as possible.