# CISA Warns Water Utilities About Cyberattacks Security risks of internet-exposed PLCs and necessary precautions. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-08-27 - **Topic:** [Business](https://brifing.si/c/business) - **Original article:** - **On Brifing:** https://brifing.si/s/a828ea03-5703-4f89-825a-97ac92030a2e ## CISA's Warning CISA revealed that over 100 internet-connected systems in the U.S. water and wastewater sector were hit by cyberattacks in July 2026. These attacks demonstrated how easily industrial systems could be compromised. Instead of an incident report, CISA published a guide to prevent similar attacks. ## PLC Security Vulnerabilities Most of the attacked systems were PLCs, small industrial computers that control pumps and valves. Many PLCs were directly connected to cellular modems without any firewall or gateway, exposing them to serious security risks. ## Simplicity of the Attacks The pattern behind the July attacks was surprisingly simple. Attackers remotely accessed PLCs, changed device IP addresses and passwords, and in some cases disabled shutdown processes and alarms, creating dangerous conditions without notifying operators. ## Iran Connection Iran is suspected to be behind much of the activity. These actions are believed to be linked to the ongoing war between the U.S. and Israel, though officials have avoided formal attribution. ## CISA's Recommendations CISA recommends organizations identify their internet-connected systems and use tools like Shodan, Censys, or CISA's Cyber Hygiene Vulnerability Scanning service. These scans should also cover ports used by industrial systems. ## Remote Access Security Where remote access is necessary, CISA advises routing everything through a secure, centrally managed gateway instead of connecting directly to PLCs. This should be implemented with additional security measures like authentication and traffic monitoring. ## Critical Infrastructure Threats The water sector attacks are part of a larger pattern of state-sponsored threats against U.S. and allied critical infrastructure. China's Volt Typhoon has reportedly pre-positioned malware in American infrastructure, and Russia has tested water and energy systems across Europe. ## Conclusion and Precautions CISA calls on all critical infrastructure organizations to secure PLC internet connections. The July 2026 attacks clearly showed the consequences of directly exposing PLCs to the internet. Therefore, security scans should be conducted without delay. ## Sources covering this story - https://securityaffairs.com/197891/ics-scada/cisa-warns-water-utilities-find-your-exposed-plcs-before-attackers-do.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._