14 min read

Cybersecurity in the Water and Wastewater Sector

Picture of Cyber Florida SOCAP Team Cyber Florida SOCAP Team : October 22, 2026

threat advisory critical infrastructure water sector

Cybersecurity in the Water and Wastewater Sector

I. Executive Summary

Affected Products
Manufacturer	Rockwell Automation / Allen Bradley	Unitronics
Product	MicroLogix 1100 and 1400 PLCs	PLCs with integrated HMI
Historical Context	July 2026 attacks targeting internet-facing water-sector equipment [1]	2023 attacks involving exposed controllers and default credentials 1111 [2]

Table 1. PLC Products Identified in Federal Cybersecurity Advisories

Note: The products listed were identified across separate federal advisories and incidents. Inclusion does not indicate that all devices were compromised or that all models were targeted specifically within the water and wastewater sector

Since July 27, 2026, malicious cyber actors have been breaking into internet-facing programmable logic controllers (PLCs) at U.S. water and wastewater utilities. The campaign began with about 30 municipal water systems in Minnesota, and the FBI confirmed incidents in at least seven states by July 30. Attackers changed passwords, IP addresses, and device settings, locking operators out of their own equipment. Some utilities were forced into manual operation, and disrupted pumps led to pressure loss, flooding, and precautionary boil-water advisories [3], [1]

These attacks did not require advanced skills. The attackers succeeded through scale, not sophistication. They searched for equipment left open to the internet and took control of what they found. This is the central lesson of this advisory. From Oldsmar, Florida, which may have involved employee error rather than an external attacker [4], to Aliquippa, Pennsylvania [5], to utilities in rural Kansas [6] and Texas, most water-sector incidents trace back to the same few preventable gaps: exposed equipment, weak or shared passwords, unsecured remote access, and former employees who still had access.

The stakes are higher than in most sectors. The United States has roughly 152,000 public drinking water systems and 16,000 wastewater systems, and many are small utilities running older technology with little or no cybersecurity staff. Because these systems control physical processes like pumping, pressure, and chemical treatment, a cyberattack on a water utility is not only a data problem. It is a public health and safety problem. This advisory reviews major water-sector incidents, explains how cyberattacks affect real-world operations, and provides practical steps utilities of any size can take to reduce their risk. Definitions of technical terms used throughout this advisory are provided in the Glossary of Terms at the end of the document.

The good news is that the most effective defenses are basic and affordable. As the FBI advises, utilities should act now to take the following steps: [1]

Remove PLCs and other operational technology from direct internet access.
Replace default and shared passwords, and require multi-factor authentication for remote access.
Revoke access immediately when employees or vendors leave.
Keep offline backups of device configurations and practice switching to manual operation.

II. Why the Water Sector is a Target

The United States has approximately 152,000 public drinking water systems and 16,000 wastewater treatment systems [7]. The ability to supply water and manage wastewater is considered a national critical function, and disruption can have debilitating effects on national security, economic stability, and public health and safety. Despite this importance, the water sector remains difficult to secure. The U.S. Government Accountability Office has reported that utilities have widely varying cybersecurity capabilities and continue to face workforce shortages, limited financial resources, and reliance on older technologies that run on legacy or outdated systems that are difficult to update or protect with modern cybersecurity controls [8].

These conditions increase the water sector’s vulnerability to state-sponsored actors, hacktivists, and cybercriminal groups. The U.S. drinking water sector is highly fragmented, with many small and rural utilities operating with limited IT or cybersecurity staff while managing geographically dispersed wells, pumps, tanks, and treatment systems [8], [9]. To operate these systems efficiently, utilities often rely on remote access and internet-connected operational technology. When those systems are exposed to the internet, protected by weak credentials, or lack proper segmentation and secure remote access, they can provide attackers with a direct path into physical operations. At that point, the threat is no longer confined to a network; it becomes a public health and safety threat.

III. Notable Water-Sector Cyber Incidents

Date	What happened	Consequence
July 26, 2026 – Present (as of this TA)	Malicious actors targeted internet-exposed operational technology (OT), including programmable logic controllers (PLCs), at U.S. water and wastewater utilities. Early activity included approximately 30 municipal water systems in Minnesota on July 26-27, where attackers reportedly changed PLC passwords and IP addresses, preventing some operators from remotely accessing their equipment. Broader campaign activity included manipulation of PLC configurations and disruption of pump operations [1], [3].	Operators were locked out of their own equipment, and some utilities had to switch to manual operation. Pump disruption contributed to water-pressure loss at some affected facilities and precautionary boil-water advisories were issued in some affected areas.
October 3, 2024	American Water Works Company detected unauthorized activity in its computer networks and systems. The company took systems offline, including customer-facing and business functions such as billing and the MyWater portal [10].	American Water activated its incident-response procedures, brought in third-party cybersecurity professionals, and notified law enforcement. The company restored its MyWater customer portal and resumed standard billing processes. American Water stated that its water and wastewater operations were not impacted [12].
January 2024	Cyber Army of Russia Reborn (CARR), a Russian government-aligned hacktivist group, claimed responsibility for compromising industrial control systems at water facilities in Abernathy and Muleshoe, Texas. CARR posted videos showing manipulation of the facilities’ human-machine interfaces (HMIs), which operators use to monitor and control industrial equipment [11].	Water storage tanks overflowed. The incidents resulted in the loss of tens of thousands of gallons of water. The U.S. Treasury reported that CARR briefly gained control of the industrial control systems, however, major damage was avoided. The U.S. Treasury attributed the limited impact to the group’s lack of technical sophistication [11].
November 25, 2023	Cyber Av3ngers, an Iran-linked hacking group, compromised a Unitronics programmable logic controller (PLC) at a remote booster station operated by the Municipal Water Authority of Aliquippa, Pennsylvania. The booster station regulates water pressure for two townships. The PLC, which controls equipment at the station, was exposed to the internet and protected by weak credentials. The attackers gained control of the device, displayed a defacement message, and disrupted its automated operation [13].	The booster station sent an alarm to operators and the station was forced into manual mode. The attackers did not gain access to the actual water treatment plant or other parts of the system beyond the pressure-regulating pump. Water quality and overall service were not affected.
August 2021	An unnamed California-based water and wastewater systems (WWS) facility was affected by Ghost variant ransomware in August 2021. Ghost, also known as Cring, is ransomware that can encrypt files or entire system storage and can inhibit recovery by deleting Windows shadow copies, after which attackers demand payment for decryption [2]. In this incident, the ransomware had reportedly been present in the system for about one month before it was discovered when three supervisory control and data acquisition (SCADA) servers displayed a ransomware message [14].	Three SCADA servers displayed ransomware messages, and the ransomware had reportedly remained in the system for about one month before detection. CISA did not specify whether treatment processes, service, or water quality were affected.
July 2021	Cyber actors used remote access to introduce ZuCaNo ransomware onto a wastewater SCADA computer at an unnamed Maine-based WWS facility [15].	The treatment system was operated manually while the SCADA computer was unavailable. Operators conducted more frequent rounds during manual operation. The SCADA computer was later restored using local control.
May 24, 2021	Washington Suburban Sanitary Commission, one of the largest water and wastewater utilities in the United States, discovered ransomware affecting a portion of its network used for nonessential business systems. The utility stated that the systems operating its water-filtration and wastewater-treatment plants were designed as stand-alone networks and were not connected to the internet. The ransomware was removed within hours, although the attackers appeared to have gained access to some internal files [16].	Water-filtration and wastewater-treatment operations were not affected. WSSC removed the malware within hours and restored affected files from backups. No significant impact to business operations was reported. The utility stated that it would not pay the ransom.
March 2021	An unnamed Nevada water or wastewater facility was reportedly affected by ransomware that impacted SCADA monitoring or visibility systems and backups [17].	Operators relied on manual operations. Public reporting did not identify the facility, exact date, or a confirmed initial-access vector
February 5, 2021	Operators at the Oldsmar Water Treatment Plant in Florida observed suspicious remote access to the plant’s Human-Machine Interface (HMI). The sodium hydroxide setpoint was changed from about 100 ppm to 11,100 ppm, a dangerous level of additive to the water supply. Reporting identified TeamViewer-style remote access and weak security controls such as shared passwords, lack of MFA, and internet-accessible remote administration [18].	The operator immediately reversed the change, and no dangerous water reached customers. Later, local official commentary introduced uncertainty over whether the event was conclusively a malicious external intrusion.
March 2019	A former Post Rock Rural Water District employee used shared credentials that had not been revoked after his resignation two months earlier to remotely access the facility’s systems [15], [19].	According to U.S. prosecutors, the former employee shut down the central Kansas water facility's cleaning and disinfecting operations. This highlights the importance of properly off-boarding employees to minimize damage that could be caused due to unauthorized access.
October 4, 2018	Onslow Water and Sewer Authority (ONWASA) in North Carolina detected an Emotet infection on October 4, 2018. Emotet is a type of malware that can establish an initial foothold in a network and, in this case, was described as polymorphic, meaning it could alter aspects of its code in ways that make detection more difficult. Nine days later, on October 13, Ryuk ransomware was deployed. Ryuk is ransomware designed to encrypt files and systems, preventing normal access until the victim restores the systems or potentially pays a ransom. At ONWASA, Ryuk encrypted files and databases across the utility’s network, leaving the organization with limited computer capabilities and requiring some customer-service functions to be performed manually [20].	Customer-service functions were disrupted and some tasks had to be completed manually. ONWASA chose not to pay the ransom and rebuilt affected systems. The utility reported that the safety of the water supply and customer information were not compromised.

IV. How Cyberattacks Can Impact Water Operations

Water and wastewater systems are different from normal IT environments because they support physical processes. A compromise affects more than computers or accounts. It can affect how operators monitor pumps, pressure, tanks, chemical dosing, alarms, and other equipment used to keep water services running. CISA notes that PLCs are used in water facilities for functions such as turning pumps on and off, filling tanks and reservoirs, pacing chemicals, collecting compliance data, and sending critical alarms to operators [21].

In a water utility, losing visibility can slow down the entire response. The FBI and EPA reported that malicious actors remotely accessed internet-facing PLCs and changed IP addresses and passwords, which caused a loss of monitoring and control functionality [1]. If operators cannot trust what they are seeing, they may not know right away whether equipment is working normally or whether a change came from an authorized user, a device failure, or an attacker. That delay can make the incident harder to contain.

Loss of control is another serious concern. The July 2026 FBI and EPA warning specifically described attacks against Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 series PLCs used in the Water and Wastewater Sector [1].

Attackers changed device configurations and set passwords. At least one organization also reported modified PLC project files after noticing ladder-logic discrepancies across several sites [1]. If a PLC is connected to important equipment, these changes can interfere with normal operations and may force the utility to use manual procedures.

Cyberattacks can also affect water pressure, treatment, and distribution. In their July 30, 2026 advisory, the FBI and EPA reported that water and wastewater utilities in at least seven states had reported incidents since July 27, with some incidents disrupting water operations [1]. The FBI and EPA also reported operational effects such as pressure loss and flooding [1]. Pressure loss is especially concerning because it can create conditions where untreated groundwater may seep into pipes, which raises water quality concerns [1].

The actual impact depends on what the affected device does. A PLC used mainly for monitoring may create visibility problems, while a PLC tied to pumps, valves, or treatment processes can create a more direct operational disruption. The FBI and EPA stated that the effect on victims depended on the PLC function, the equipment involved, the process supported by the device, and whether the utility could switch to manual operations [1].

These incidents can also put pressure on the people responsible for restoring service. After a compromise, a utility may need to isolate devices, reset credentials, review project files, restore known-good configurations, check logs, coordinate with vendors, and report the incident to government partners [1]. Smaller utilities may face additional challenges because they have limited staffing and resources for monitoring IT and OT systems. The American Water Works Association (AWWA) also notes that cyberattacks can lead to service outages, public health concerns, reputational damage, recovery costs, regulatory scrutiny, and employee strain [22].

For water utilities, a cyberattack can disrupt the equipment and processes that keep water service running. Operators may lose the ability to monitor conditions or control equipment, making it harder to maintain pressure, manage treatment, and distribute water. Even an incident affecting a few devices may require manual operations and additional recovery work, with possible effects on the communities the utility serves.

V. How to Reduce Risk and Stay Safe

A. Remove direct internet exposure from PLCs

Water and wastewater utilities should identify exposed operational technology (OT) devices and secure the connections used to access them remotely.

Identify PLCs, HMIs, and other OT equipment that can be reached from the public internet. Check cellular modems and vendor-installed connections, which may be undocumented or missed during routine attack-surface scans [23].
Remove direct internet access to PLCs. Route necessary remote access through a secure gateway, jump host, or VPN, and use firewall rules to restrict connections [1], [23].
Secure cellular modems with strong authentication and keep them updated [1].
Enable logging on connected modems and regularly review the logs for suspicious activity [1].
Separate OT and IT networks using firewalls and a demilitarized zone (DMZ) to control communication between them. Block connections by default and allow only those needed for approved operations. Monitor and log permitted connections to help detect attempts to move from compromised IT systems into OT [24].

These measures address the access path described by the FBI and EPA, where attackers remotely accessed exposed PLCs and changed device IP addresses and passwords, disrupting monitoring and control [1].

B. Strengthen passwords, MFA, and access control

Strong credentials and restricted network access help prevent unauthorized connections to OT equipment.

Use strong, unique passwords for OT devices [1].
Replace default passwords. For Unitronics PLCs, confirm that the default password “1111” is not in use [21].
Require multifactor authentication for all remote access to the OT network, including access from IT networks and external networks. Where a PLC does not support MFA, use a VPN or gateway that provides it [21].
Configure firewall rules or access control lists to allow only authorized communication between expected control system devices and PLCs [1].

C. Protect PLC logic, configurations, and device integrity

Regular integrity checks help identify unauthorized changes, while verified backups support recovery.

Back up PLC logic and configurations, and verify that backups do not contain malicious logic before restoring them [1], [21].
Review PLC project files and compare the running program with a known-good version. Use vendor-provided integrity-checking tools where available and validate reusable logic and input/output configurations [1].
Validate project files before placing supported controllers into run mode. Follow the manufacturer’s instructions for physical or software key switches, and return controllers to run mode after authorized programming work is complete [1].
For Unitronics PLCs and HMIs, install the latest updates provided by the manufacturer [21].
Plan to replace or isolate devices that no longer receive security updates [1].

The FBI and EPA reported that at least one organization found modified PLC project files after noticing ladder-logic discrepancies across several sites. Checking device integrity is therefore an important part of both prevention and recovery [1].

D. Prepare for manual operations and incident response

Operators need clear, practiced procedures for keeping critical processes running safely when automated monitoring or control becomes unavailable.

Maintain and practice procedures for switching to manual operations [1].
Regularly test business continuity and disaster recovery plans, fail-safe mechanisms, backups, and standby systems [1].
Review logs and configurations on connected modems, HMIs, and workstations to identify unauthorized access or possible lateral movement [1].
If similar OT outages occur, contact the local FBI field office and file a complaint with IC3. Incidents can also be reported to CISA. Include PLC model numbers, serial numbers, IP addresses, and unusual IP addresses observed on connected networks [1].
Utilize the EPA Cybersecurity Assessment Page to access free self-assessment tools, cybersecurity evaluations, vulnerability scanning, and technical assistance [25].
Use CISA’s free vulnerability scanning service to identify known vulnerabilities and exposed devices on internet-facing systems. Utilities can request the service by emailing vulnerability@cisa.dhs.gov with the subject line “Requesting Cyber Hygiene Services” [26].
AccessWaterISAC resources for water-sector cybresecurity alerts, incident reports, security guidance,and training materials. Some resources are publicly available, while full membership provides additional services [27].

Utilities do not have to address cybersecurity challenges alone. Federal agencies and water-sector organizations provide resources and assistance, and collaboration can help utilities share knowledge, strengthen defenses, and improve resilience.

Preparing these procedures in advance can help operators respond more effectively during a disruption. This preparation is particularly important for smaller utilities with limited staffing and resources for monitoring IT and OT systems [22].

VI. Glossary of Terms

Human-Machine Interface (HMI): A system that allows operators to monitor and control industrial equipment.

Operational Technology (OT): Hardware and software used to monitor or control physical equipment and industrial processes.

Programmable Logic Controller (PLC): An industrial controller used to automate equipment and processes such as pumps, valves, and treatment systems.

Sodium Hydroxide (NaOH): Also known as caustic soda or lye, is the main ingredient in liquid pipe cleaners. It is also used to control the acidity of water and remove metals from drinking water treatment plants.

VII. References

[1] Federal Bureau of Investigation (FBI) and U.S. Environmental Protection Agency (EPA). (2026, July 30). Malicious Cyber Actors Targeting Water and Wastewater Sector Internet-Facing Programmable Logic Controllers, Causing Operational Disruptions. https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet--facing-programmable-logic-controllers-causing-operational-disruptions

[2] Cybersecurity and Infrastructure Security Agency (CISA) et al. (2023, December 1; updated December 18, 2024). IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities. Joint Cybersecurity Advisory AA23-335A. https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a

[3] Center for Strategic and International Studies (CSIS). (2026, August 18). Mapping Iranian Cyberattacks on U.S. Water Systems. https://www.csis.org/analysis/mapping-iranian-cyberattacks-us-water-systems

[4] U.S. Environmental Protection Agency Office of Inspector General (EPA OIG). (2021, July 23). Notification of Audit: Addressing Cybersecurity Risks to Community Water Systems under the America’s Water Infrastructure Act of 2018. Memorandum, Project No. OA-FY21-0240. https://www.epa.gov/system/files/documents/2021-07/_epaoig_notificationmemo_7-23-21_cybersecurity_0.pdf

[5] CBS News Pittsburgh. (2023, November 26). Municipal Water Authority of Aliquippa Hacked by Iranian-Backed Cyber Group. https://www.cbsnews.com/pittsburgh/news/municipal-water-authority-of-aliquippa-hacked-iranian-backed-cyber-group/

[6] U.S. Department of Justice (DOJ). (2021, October 21). Kansas Man Pleads Guilty to Water Facility Tampering. https://www.justice.gov/usao-ks/pr/kansas-man-pleads-guilty-water-facility-tampering

[7] Cybersecurity and Infrastructure Security Agency (CISA). (n.d.). Water and Wastewater Systems Sector. https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector

[8] U.S. Government Accountability Office (GAO). (2026, May 21). Critical Infrastructure Protection: Actions Needed to Address Persistent Cybersecurity Threats to the Water and Wastewater Sector. GAO-26-109159. https://www.gao.gov/products/gao-26-109159

[9] National Association of Water Companies (NAWC). (n.d.). Water Infrastructure in the United States. https://nawc.org/water-industry/infrastructure-investment/

[10] American Water. (2024, October 10). American Water Reactivating Systems After Cyber Event. https://www.amwater.com/press-room/press-releases/corporate/american-water-reactivating-systems-after-cyber-event-10102024

[11] U.S. Department of the Treasury. (2024, July 19). Treasury Sanctions Leader and Primary Member of the Cyber Army of Russia Reborn. https://home.treasury.gov/news/press-releases/jy2473

[12] American Water. (2024, October 10). IT Security FAQs – Reactivation of Systems. https://amwater.com/corp/security-faq

[13] CyberScoop. (2023, November 28). Pennsylvania Water Facility Hit by Iran-Linked Hackers. https://cyberscoop.com/pennsylvania-water-facility-hack-iran/

[14] Cybersecurity and Infrastructure Security Agency (CISA) et al. (2021, October 14). Ongoing Cyber Threats to U.S. Water and Wastewater Systems. Joint Cybersecurity Advisory AA21-287A. https://media.defense.gov/2021/Oct/14/2002873650/-1/-1/0/CSA_ONGOING_CYBER_THREATS_TO_U.S._WATER_AND_WASTEWATER_SYSTEMS_20211014.PDF

[15] Cybersecurity and Infrastructure Security Agency (CISA) et al. (2021, October 14). Ongoing Cyber Threats to U.S. Water and Wastewater Systems. Joint Cybersecurity Advisory AA21-287A. https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-287a

[16] Washington Suburban Sanitary Commission (WSSC Water). (2021, June). WSSC Water Investigating Ransomware Cyberattack. https://content.govdelivery.com/attachments/MDPGCLEG/2021/06/27/file_attachments/1864453/WSSC%20Water%20Investigating%20Ransomware%20Cyberattack.pdf

[17] Reuters. (2021, October 14). U.S. Authorities Disclose Ransomware Attacks Against Water Facilities. https://www.reuters.com/legal/government/us-authorities-disclose-ransomware-attacks-against-water-facilities-2021-10-14/

[18] Reuters. (2021, February 8). Hackers Broke Into Florida Town's Water Treatment Plant, Attempted to Poison Supply, Sheriff Says. https://www.reuters.com/article/us-usa-cyber-florida/hackers-broke-into-florida-towns-water-treatment-plant-attempted-to-poison-supply-sheriff-says-idUSKBN2A82FV/

[19] Water Information Sharing and Analysis Center (WaterISAC). (2021, October 21). Insider Threat – Former Employee Indicted for Unauthorized Computer Access with Intent to Harm a Kansas Public Water District. https://www.waterisac.org/updated-october-21-2021-insider-threat-former-employee-indicted-unauthorized-computer

[20] CyberScoop. (2018, October 15). Ransomware Hits Computer Networks of North Carolina Water Utility. https://cyberscoop.com/ransomware-hits-onwasa-computer-network-north-carolina-water-utility/

[21] Cybersecurity and Infrastructure Security Agency (CISA). (2023). IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities. CISA Security Advisory Bulletin. https://content.govdelivery.com/accounts/USDHSCISA/bulletins/37d467f

[22] American Water Works Association (AWWA). (2018). Cybersecurity Risk & Responsibility in the Water Sector. Prepared by Judith H. Germano. https://www.waterisac.org/wp-content/uploads/2018/10/AWWACybersecurityRiskandResponsibility-698.pdf

[23] Cybersecurity and Infrastructure Security Agency (CISA). (2026, July 30). CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs. https://www.cisa.gov/news-events/alerts/2026/07/30/cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs

[24] U.S. Environmental Protection Agency (EPA). (2024, July). Protect: Network Segmentation. EPA Guidance on Improving Cybersecurity at Drinking Water and Wastewater Systems, Factsheet 2.F. https://www.epa.gov/system/files/documents/2024-07/segment-ot-and-it.pdf

[25] U.S. Environmental Protection Agency (EPA). (n.d.). Cybersecurity Assessments. https://www.epa.gov/cyberwater/cybersecurity-assessments

[26] Cybersecurity and Infrastructure Security Agency (CISA). (n.d.). Cyber Hygiene Services. https://www.cisa.gov/cyber-hygiene-services

[27] Water Information Sharing and Analysis Center (WaterISAC). (n.d.). WaterISAC Publications. https://www.waterisac.org/waterisac-publications

Threat Advisory created by The Cyber Florida Security Operations Center.

Contributing Security Analysts: Waratchaya (June) Luangphairin, Sneha Lama, Sanae Elmachhour

BRICKSTORM APT Intrusion Campaign

Cyber Florida SOCAP Team : September, 16, 2026

Originally Published December 3, 2025

1 min read

LockBit Operators Utilizing New AV-Bypass Tool

Cyber Florida SOCAP Team : August, 14, 2026

Published 07/08/2024

threat advisory ransomware LockBit