CISA Warns Water Utilities About Cyberattacks
Security risks of internet-exposed PLCs and necessary precautions.
1CISA's Warning
CISA revealed that over 100 internet-connected systems in the U.S. water and wastewater sector were hit by cyberattacks in July 2026. These attacks demonstrated how easily industrial systems could be compromised. Instead of an incident report, CISA published a guide to prevent similar attacks.
2PLC Security Vulnerabilities
Most of the attacked systems were PLCs, small industrial computers that control pumps and valves. Many PLCs were directly connected to cellular modems without any firewall or gateway, exposing them to serious security risks.
3Simplicity of the Attacks
The pattern behind the July attacks was surprisingly simple. Attackers remotely accessed PLCs, changed device IP addresses and passwords, and in some cases disabled shutdown processes and alarms, creating dangerous conditions without notifying operators.
4Iran Connection
Iran is suspected to be behind much of the activity. These actions are believed to be linked to the ongoing war between the U.S. and Israel, though officials have avoided formal attribution.
5CISA's Recommendations
CISA recommends organizations identify their internet-connected systems and use tools like Shodan, Censys, or CISA's Cyber Hygiene Vulnerability Scanning service. These scans should also cover ports used by industrial systems.
6Remote Access Security
Where remote access is necessary, CISA advises routing everything through a secure, centrally managed gateway instead of connecting directly to PLCs. This should be implemented with additional security measures like authentication and traffic monitoring.
7Critical Infrastructure Threats
The water sector attacks are part of a larger pattern of state-sponsored threats against U.S. and allied critical infrastructure. China's Volt Typhoon has reportedly pre-positioned malware in American infrastructure, and Russia has tested water and energy systems across Europe.
8Conclusion and Precautions
CISA calls on all critical infrastructure organizations to secure PLC internet connections. The July 2026 attacks clearly showed the consequences of directly exposing PLCs to the internet. Therefore, security scans should be conducted without delay.
Original article: Security Affairs — CISA, Su Şirketlerini Siber Saldırılara Karşı Uyardı