Internet-Facing PLC Cyberattacks Hit 30+ U.S. Water Systems in 2026
On this page
Internet-Facing PLC Cyberattacks Hit 30+ U.S. Water Systems in 2026
Between March and July 2026, a wave of internet-facing PLC cyberattacks swept through U.S. municipal water systems, forcing operators in more than 30 Minnesota communities, and at least seven states nationwide, to lock down their industrial automation assets. Adversaries needed no zero-day exploits; they simply exploited default credentials and exposed remote-programming ports on legacy controllers.
Detail
This campaign is not a sophisticated nation-state operation. It is an industrial-scale test of a known truth, that thousands of PLCs and HMIs are still deployed with factory defaults and direct internet exposure. The attackers did not defeat security; they found where security was never installed.
Xage's security analysis documents a coordinated sequence of intrusions in which adversaries modified credentials, changed controller IP addresses, and overwrote project files across exposed controllers. Each action was designed to disrupt normal operation and lock out legitimate operators.
The targets were overwhelmingly legacy Rockwell Automation and Allen-Bradley controllers, including MicroLogix 1100 and 1400 units, alongside aging HMIs. These devices are ubiquitous in water and wastewater treatment, where budgets favor longevity over modernization.
More than 30 Minnesota water systems report simultaneous intrusions, including the city of Plymouth.
CISA issues an urgent advisory urging the Water and Wastewater Systems sector to remove publicly exposed PLCs from the internet.
The FBI and EPA confirm incidents across at least seven states, with Michigan reporting nine affected systems.
Most water utilities operate on a cost-sensitive refresh cycle. Legacy PLCs and HMIs are often deployed with default settings, unchanged credentials, and remote-programming ports opened for integrator convenience, then never closed.
Sourcing help
Send the BOM for one quote covering active stock, EOL stock and cross-references.
Need a quote for this part?
Send us the part number or article link — we will confirm price, availability and lead time.
