After the July 2026 attacks on more than 100 U.S. water systems, organizations should first remove operational technology from the public internet.
They should also replace default controller passwords, allowlist remote access, and segment business and plant networks. A programmable logic controller is the rugged computer that operates pumps, valves, and treatment steps. TechCrunch reported the July activity spanned Michigan, Minnesota and at least five other states the TechCrunch account.
Table of Contents
- How attackers got in and took control
- Which controllers and credentials face the most risk
- What should organizations fix next
- Where the investigation still has limits
How attackers got in and took control
Pew Trusts reports attackers hit water and wastewater utilities in more than 30 Minnesota communities on July 26-27, 2026. Some systems went offline, disconnected equipment, or shifted to manual operation. Tenable Research says intruders remotely accessed controllers, changed passwords and IP addresses, stole project files, and disabled monitoring and control the Tenable Research summary.
Affected utilities faced operational disruption, boil-water notices, and sustained manual operations. The joint advisory AA26-097A, updated July 22, 2026, ties the activity to Iran-affiliated actors. LevelBlue SpiderLabs reports the advisory says those actors had compromised internet-exposed controllers since at least March 2026.
Which controllers and credentials face the most risk
The advisory names Rockwell controllers, Schneider Electric BMX P34 and Modicon M340 units, and Siemens S7-1200 controllers. These are common plant-floor controllers that should never face the public internet directly. CISA, the FBI, and NSA warned Aug. 20, 2026 that hackers are targeting all Siemens S7 controllers in water, energy, and manufacturing.
TechCrunch reported the agencies said attackers are using AI to speed reconnaissance and exploitation of vulnerable systems. Stolen logins widen the risk beyond exploits. SpyCloud analysis of 66,000 EPA-registered public systems found infostealer malware had taken employee passwords and active session tokens from 1,787 water providers, TechCrunch reported the TechCrunch report on stolen passwords. A valid password plus an active token can allow login without breaking software.
What should organizations fix next
CISA's July 30, 2026 water-sector alert lists the immediate fixes: remove operational technology from direct internet exposure, change controller and interface passwords, and control remote access the CISA water-sector alert. CISA also urges network segmentation, asset inventory, backups, and incident-plan exercises.
Apply the list in an order that stops remote takeover first: Back up controller logic and station configurations offline and test restoration. Run a tabletop exercise for loss of remote monitoring, forced manual operation, and a boil-water notice.
- Disconnect controllers and human-machine interfaces from direct internet access.
- Change all default and shared controller passwords and audit remote accounts.
- Route remote access through a VPN or gateway and allowlist approved addresses.
- Segment business and plant networks and inventory internet-facing assets.
Where the investigation still has limits
Attribution does not cover every incident. Reuters reported Aug.
26, 2026 that a separate FBI-probed breach at a Kansas water-technology supplier appeared unrelated to the suspected Iranian-affiliated Minnesota campaign. Treat supplier access, contractor VPN accounts, and shared maintenance logins as part of the same review. Reset potentially exposed credentials, revoke idle remote accounts, and check supplier connections before restoring normal operations.
You Might Also Like
- Cybersecurity — Salt Typhoon: What Organizations Should Fix Next
- Cybersecurity — Lazarus Group: What Organizations Should Fix Next
- Akira Ransomware: What Organizations Should Fix Next