Water utility cyberattacks highlight OT cybersecurity risks

Recent attacks against U.S. drinking water and wastewater utilities highlight a growing challenge across critical infrastructure. Operational technology (OT) environments were designed for reliability and availability, not protection from cyber threats.

As facilities modernize and increase connectivity, legacy systems and devices exposed to the public internet create pathways for unauthorized access and disruption.

Threats to internet-accessible OT

On July 30, 2026, the FBI and EPA issued a public warning after multiple utilities reported cyber incidents involving internet-accessible OT. The activity specifically targeted Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers (PLCs). These PLCs act as the digital brains of the facility, reading data from sensors and automatically controlling physical equipment such as pumps and valves.

The FBI has not publicly identified the utilities involved. However, at least 12 states have reported cyberattacks, targeted reconnaissance, or operational intrusions.

Although the incidents were contained and haven’t caused widespread impacts on water supplies or treatment, they underscore the importance of appropriate safeguards.

In “July 2026 Water System Cyber Incidents: Considerations for Congress,” the U.S. Congressional Research Service (CRS) reported that out of 49,500 community water systems in the U.S., smaller systems make up 81%. These facilities often lack dedicated IT personnel, making them particularly vulnerable.

OT security is an operational resilience issue

OT cybersecurity has become a critical component of operational resilience.

The threat actors involved in these events interacted directly with equipment responsible for controlling physical water processes. According to the FBI, they accessed internet-facing PLCs and changed IP addresses and passwords, effectively locking out plant workers. Once in control, they altered pump cycles, disabled safety alarms, and manipulated system data. Media reporting also indicates that unauthorized changes were made to at least one facility’s automation software. Operational consequences included loss of water pressure and flooding.

The incidents are significant because they crossed the traditional boundary between an information security event and a physical process event.

For water utility leaders, the key takeaway is that cybersecurity risks quickly become operational risks when OT environments are involved. Manipulation of pumps, valves, tank levels, pressure, chemical processes, and other automated functions can affect equipment availability, environmental compliance, continuity of service, and public safety.

The America’s Water Infrastructure Act of 2018 (AWIA) requires systems serving populations greater than 3,300 to assess risks and resilience and maintain emergency response plans. It doesn’t apply to smaller utilities. The recent attacks on internet-accessible PLCs highlight the critical importance of incorporating OT cybersecurity into those efforts, regardless of system size.

How foundational security gaps created OT risk

The most concerning aspect of the FBI and EPA warning is also the most actionable: attackers gained access through poor cyber hygiene rather than sophisticated intrusion techniques.

They simply identified internet-exposed PLCs and accessed them remotely.

While the FBI identified Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 PLCs in the reported incidents, the underlying security concerns extend to PLCs manufactured by other vendors.

“The sad thing is, these aren’t unique vulnerabilities. They’re actually just basic cybersecurity controls we’ve known about for, honestly, decades.”

Michael Garcia, Vice President of Government Relations at Monument Advocacy

Threat actors don’t need to compromise a network, deploy sophisticated malware, or obtain domain administrator privileges to disrupt operations.

OT devices such as PLCs, actuators, and supervisory control and data acquisition (SCADA) systems were designed to operate in isolated, physically secure environments. Leaving these devices exposed to the internet offers a direct path to critical systems.

A compromised office workstation may create a confidentiality issue. A compromised OT PLC can impact service delivery and potentially threaten public safety. Concern about these risks is growing, driving attention at the federal level.

In July, a bipartisan U.S. Senate committee introduced the Water Resources Development Act. The act aims to authorize more than $35 billion in funding for water infrastructure programs over the next four years, with an explicit focus on OT cybersecurity and resilience.

Security fundamentals are non-negotiable

• Disconnect OT assets from the public-facing internet. Internet-facing PLCs, human-machine interfaces (HMIs), remote terminal units (RTUs), engineering workstations, or SCADA interfaces should be treated as critical, high-risk findings requiring immediate remediation.
• Enforce strong, unique passwords. Shared, weak, or vendor-standard OT credentials represent an unacceptable gateway to physical-process compromise.
• Control network access to PLC devices. Remote access into OT environments should terminate through controlled security gateways rather than directly at controllers.
• Separate your networks. IT and OT environments should be properly segmented to limit unauthorized access and restrict lateral movement between enterprise systems and process-control networks.
• Build a complete asset inventory. Maintaining visibility into PLCs, HMIs, RTUs, engineering workstations, servers, network equipment, remote-access systems, and externally exposed assets helps identify vulnerabilities.
• Practice your incident response plan. OT incident-response procedures should include rapid isolation, transition to manual operation, engineering validation, configuration restoration, forensic preservation, regulatory notification, and safe return to automated control.
• Back up all critical systems. Known-good PLC programs, configurations, firmware, HMI applications, OT data historian configurations, network-device configurations, and engineering files must be backed up and recoverable.
• Monitor industrial network traffic. Traffic should be continuously monitored for unauthorized programming commands, controller configuration changes, abnormal engineering-workstation communications, new remote sessions, authentication failures, and unexpected internet communications.

These practices align with earlier joint guidance from NIST, CISA, EPA, and the FBI.

Building operational resilience through OT cybersecurity

The attacks on U.S. water utilities demonstrate that OT cybersecurity is no longer just an IT concern. It is a key component of operational resilience, public trust, and service continuity.

As critical infrastructure modernizes, foundational security controls need to be reinforced. Reducing exposure, improving visibility, and strengthening cyber hygiene can help teams prevent and respond to similar incidents.

Many water utilities, particularly smaller systems, face resource and staffing constraints that can make maintaining effective cybersecurity challenging.

Improving cybersecurity maturity with SHI

SHI works with organizations to evaluate the maturity of security controls and develop practical roadmaps aligned with operational and business priorities. Through cybersecurity assessments, network architecture reviews, and tabletop exercises, we focus on strengthening resilience across IT and OT environments.

We help build proactive cybersecurity programs designed to reduce risk, improve preparedness, and support reliable operations.

NEXT STEPS

Speak with an SHI expert to evaluate your OT security posture and identify opportunities to reduce risk and strengthen resilience.

Our Security Posture Review provides technical analysis and practical risk-based recommendations.