CISA Warned That Internet-Exposed Water PLCs Are Being Taken Offline

A water facility can look connected, modern, and remotely manageable while exposing the controls that actually move the system. On July 30, 2026, CISA warned that threat actors were targeting internet-exposed programmable logic controllers—PLCs—in the water and wastewater sector. CISA said it was observing a significant increase in this activity and that the targeting affected water organizations of all sizes. The alert was contributed to by the Environmental Protection Agency and the FBI. What the alert describes According to CISA, threat actors targeting exposed PLCs modified passwords to lock out operators and changed IP addresses to disconnect the controllers. The agency said the activity had caused boil-water notices and sustained manual operations. CISA also warned that exposed assets may include cellular modems installed by operators, vendors, or system integrators—connections that may not appear in routine attack-surface scans. A system can therefore be exposed even when the organization believes its known internet perimeter is documented. The alert does not attribute the activity to a named actor. It describes observed behavior and operational consequences, not a final finding about who is responsible for every incident. Why a PLC is not just another endpoint A PLC is part of an operational technology system. A change to an office laptop may create a security and productivity problem; a change to a controller can affect treatment, pumping, pressure, or other physical processes. The security model is also different. Operators may need availability and predictable control more than frequent software changes. Legacy equipment can have limited authentication, logging, or recovery options. A remote-access shortcut created for maintenance can become the path that changes a password or control setting. This is why “we have a firewall” is not enough. Defenders need to know which devices are exposed, which remote connections exist, which vendor accounts can reach them, and how to restore a known-clean configuration when access is lost. CISA’s immediate mitigations CISA recommends that owners, operators, and integrators: Disconnect PLCs from the internet. Route legitimate remote access through a VPN or gateway instead of connecting directly to the PLC. Enable password protection and change default passwords. Allowlist only known engineering laptops or other critical OT assets. Keep a known-clean backup of the PLC image after disconnecting it from the internet. Look beyond routine scans for undocumented cellular modems and vendor connections. These are operational controls, not a request to install a single magic product. The goal is to reduce the number of paths that can change a physical control system and to preserve a recovery path when an attacker changes credentials. The practical audit Water utilities and their integrators can begin with a short inventory: List every PLC, modem, gateway, vendor tunnel, and engineering laptop. Test whether any controller answers directly from the public internet. Remove default credentials and verify that password changes are logged. Confirm that remote access passes through an approved gateway or VPN. Restore a PLC image in a controlled exercise instead of assuming the backup works. Write down who can respond if an operator is locked out during an active process. Critical infrastructure security often fails at the edges: an old modem, a vendor account, an undocumented route, or a controller that was never meant to be public. CISA’s alert turns those edges into the first places to look.