FBI & EPA Alert: PLC Cyberattacks Disrupt US Water Systems in 12 States

Detail

This is not a hypothetical scenario. The FBI has confirmed operational disruptions across at least 12 states , including Michigan, Minnesota, Georgia, New Jersey, and South Dakota , with effects ranging from loss of monitoring and control to physical flooding. The advisory specifically flags Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 series PLCs, but CISA has also identified targeting of Schneider Electric, Siemens, and other manufacturers. The threat is vendor-agnostic and escalating.

The attack methodology is alarmingly straightforward. Threat actors scan the public internet for exposed OT devices , specifically PLCs that have been left accessible without adequate firewall protection or network segmentation. Once located, they remotely access these devices, change administrator passwords, and alter IP configurations, effectively locking out legitimate operators while maintaining control themselves.

As Joshua Corman, executive-in-residence for public safety and resilience at the Institute for Security and Technology, explains: PLCs operate on simple conditional logic , "if this happens, then that happens." A hacker who gains access can disable the alerts that notify employees of system malfunctions, manipulate water pressure thresholds beyond safe limits, or shut down critical pumps before equipment sustains damage. In some documented cases, attackers have reconfigured PLCs to ignore safety interlocks entirely.

Sudden drops in water pressure, potentially allowing untreated groundwater to seep into distribution pipes , a public health hazard.

Uncontrolled pump operation or valve manipulation causing physical overflow and infrastructure damage.

Operators locked out of monitoring interfaces, losing real-time awareness of system conditions.

Facilities compelled to switch to manual operations, increasing labor costs and reducing response precision.