Hackers Exploit Internet-Exposed Rockwell PLCs Across U.S. Water Systems — What Industrial Operators Must Do Now

7 Agustus 2026

Why This Matters Now

Since July 27, 2026, a coordinated cyber campaign has systematically targeted internet-facing Rockwell Automation programmable logic controllers (PLCs) in U.S. water and wastewater systems — successfully disrupting operations across at least seven states. The Federal Bureau of Investigation (FBI) and Environmental Protection Agency (EPA) issued an urgent joint Public Service Announcement on July 30, 2026, confirming that malicious cyber actors are exploiting a fundamental and long-standing weakness: industrial controllers sitting on the public internet with either no passwords or factory-default credentials.

This campaign is not an isolated incident. It escalates a threat pattern that CISA, the NSA, and international partners first flagged in April 2026 under advisory AA26-097A, tying the activity to Iranian-affiliated advanced persistent threat (APT) actors. The water sector attacks represent a dangerous evolution — from reconnaissance to operational disruption — and signal that critical infrastructure operators can no longer afford to treat PLC security as an afterthought.

Analyst Insight: Dragos' 2026 OT/ICS Cybersecurity Year in Review reported a 64% year-over-year surge in ransomware attacks against industrial organizations and a 49% increase in threat groups targeting OT environments. Adversaries are progressing from passive reconnaissance to genuine operational disruption, making the water-sector PLC attacks a bellwether for what lies ahead across manufacturing, energy, and transportation sectors.

The Attack Vector: Internet-Exposed PLCs with No Authentication

The FBI and EPA advisory specifically identifies Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 series PLCs as the primary targets — though the agencies caution that similar risks apply to controllers from Schneider Electric, Siemens, and other manufacturers. The attack methodology is technically simple but operationally devastating: threat actors scan for internet-facing industrial devices on standard engineering ports, authenticate using default or absent credentials, then lock legitimate operators out.

Once inside, attackers are changing IP addresses and passwords on compromised controllers, severing the utility's monitoring and control capability. At multiple victim sites, the FBI observed adversaries downloading malicious project files — the .ACD files containing ladder logic that governs how physical equipment behaves. In one documented case, modified logic overrode instruction sets responsible for maintaining safe operating parameters.

Market Trend: Security researchers at Forescout identified 4,407 internet-exposed Rockwell Automation/Allen-Bradley PLCs directly reachable through the EtherNet/IP engineering protocol on TCP port 44818. This staggering exposure figure underscores a systemic failure in OT network architecture — and represents an attack surface that adversaries are now actively exploiting at scale.

The MicroLogix Vulnerability Landscape

The MicroLogix 1100 and 1400 series carry known vulnerabilities that compound the risk of internet exposure. CVE-2022-46670 — an unauthenticated stored cross-site scripting vulnerability in the embedded webserver — allows remote code execution via SNMP-delivered payloads. CVE-2022-3166 enables denial-of-service through a clickjacking vector that can crash the webserver application. The Canadian Centre for Cyber Security has also flagged five additional vulnerabilities in these controller families, ranging from medium to critical severity.

Yet the current campaign does not rely on exploiting these CVEs. Attackers are succeeding through the simplest possible vector: authentication bypass via default credentials on devices that should never have been reachable from the public internet in the first place.

Key Attack Timeline: 2026 Water Sector PLC Campaign

March 2026	Iranian-affiliated APT activity targeting internet-exposed OT devices first observed across U.S. critical infrastructure.
April 7, 2026	CISA, FBI, NSA, and international partners issue Joint Advisory AA26-097A on Iranian exploitation of internet-connected PLCs.
June 2026	Shodan scans reveal thousands of Rockwell Automation/Allen-Bradley ICS hosts globally exposed on the public internet.
July 22, 2026	CISA updates AA26-097A with new guidance on detecting malicious changes in reusable code modules within Rockwell .ACD project files.
July 26–27, 2026	Coordinated attack on more than 30 water systems in Minnesota, including Plymouth, South St. Paul, Maple Plain, and Braham.
July 30, 2026	FBI and EPA issue joint Public Service Announcement confirming operational disruptions across seven U.S. states.

Operational Impact: Locked Out of Critical Infrastructure

The consequences of these attacks extend far beyond the IT realm. When threat actors change IP addresses and passwords on a water treatment PLC, utility operators lose visibility into pump status, chemical dosing, tank levels, and pressure readings. The loss of monitoring and control capability means operators cannot remotely adjust processes, respond to alarms, or verify safe operating conditions — creating scenarios where physical equipment may continue running on the last-known configuration without any human oversight.

In the Minnesota incidents, municipalities including Plymouth and South St. Paul reported degraded water operations following the coordinated July 26–27 attacks. While no drinking water safety violations have been publicly confirmed, the FBI advisory explicitly warns that modified project files altered logic governing safe operating parameters — a scenario that directly threatens process safety.

Analyst Insight: The Dragos 2026 report reveals that only 30% of OT networks have meaningful visibility into their industrial environments. 56% cannot see below the IT/OT boundary, and 88% struggle with detection and response. For water utilities targeted in this campaign, the average time to detect an OT compromise likely far exceeds the industry-wide benchmark of 42 days — meaning many victim organizations may still be unaware they have been breached.

Immediate Mitigation: What Operators Must Do

The FBI and EPA advisory outlines clear, actionable steps for asset owners and operators. The first and most critical recommendation is unambiguous: remove PLCs from direct internet exposure immediately. Every controller reachable via Shodan or similar scanning platforms represents a live target.

Essential Security Measures

Network Architecture: Place all PLCs behind secure industrial firewalls and VPN gateways. Implement network segmentation that isolates OT devices from both the internet and enterprise IT networks. Configure Access Control Lists (ACLs) that permit only authorized communication between known control system devices.

Authentication: Replace all default credentials with strong, unique passwords. Implement role-based access control and disable shared or dormant accounts. For Rockwell Automation environments, leverage built-in security features including programming protection via software key switching.

Port Management: Block TCP/UDP port 44818 (EtherNet/IP) at the perimeter firewall. Disable unused services including HTTP/HTTPS on web server modules when remote web access is not operationally required.

Project File Integrity: Review .ACD project files running on PLCs for unauthorized modifications. Use vendor-provided integrity checking tools and visually compare running logic against known-good baselines. Pay particular attention to Add-On Instructions (AOIs) and reusable code modules, which CISA's July 22 update identified as a specific target for malicious modification.

FAQ: Rockwell PLC Cybersecurity

Q: Why are MicroLogix 1100 and 1400 models specifically targeted?
These models are widely deployed in smaller municipal water systems, often by utilities with limited cybersecurity resources. Their embedded webservers, SNMP capabilities, and EtherNet/IP connectivity make them discoverable and accessible — and many units in the field have never had default credentials changed since installation.

Q: Is there a patch for the exploited vulnerabilities?
The current campaign does not primarily exploit software vulnerabilities — it exploits configuration failures. However, Rockwell Automation has released security updates for the MicroLogix 1100 and 1400 addressing CVE-2022-46670 and CVE-2022-3166. Operators should apply these updates, but patching alone will not protect an internet-exposed PLC.

Q: Are other PLC brands at risk?
Yes. The CISA advisory explicitly names Schneider Electric, Siemens, and potentially other manufacturers as targets of the same threat actors. Any internet-facing industrial controller — regardless of brand — should be considered at risk.

Q: How can operators detect if their PLC has been compromised?
Check for unexplained IP address changes, modified passwords, unexpected project file modifications, and anomalous network traffic. Compare running ladder logic against known-good configurations. Review AOIs for unauthorized changes. If a PLC is no longer responding to legitimate engineering software, treat it as potentially compromised.

Q: What should a utility do if it discovers a compromise?
Immediately isolate the affected PLC from the network. Contact the FBI and CISA through established reporting channels. Preserve forensic evidence including project files, network logs, and controller memory. Do not simply restore from backup without investigating how the attacker gained access — the exposure path must be closed first.

The Broader Industrial Automation Security Imperative

This campaign is not merely a water-sector problem. It reflects a structural weakness across the entire industrial automation ecosystem. Dragos documented 1,020 ransomware incidents impacting industrial organizations worldwide in Q1 2026 alone, with manufacturing accounting for 62% of victims. The 49% year-over-year increase in ransomware groups targeting industrial organizations signals that OT environments have become a primary — not incidental — target for financially and politically motivated threat actors.

The convergence of IT and OT, accelerated by Industry 4.0 initiatives, has dramatically expanded the attack surface. Every sensor, drive, HMI, and PLC connected to a routable network represents a potential entry point. The water-sector attacks demonstrate that adversaries understand industrial protocols, engineering software, and process logic well enough to cause targeted operational disruption — not just generic IT damage.

Market Trend: The SANS State of ICS/OT Security 2025 Report found that most organizations struggle less with identifying threats than with understanding their own OT environments. The gap between IT security maturity and OT security maturity remains vast — and adversaries are exploiting that gap with increasing precision. For system integrators, engineering firms, and industrial equipment vendors, the current campaign underscores a growing market demand for security-hardened automation solutions and OT-aware managed security services.

Looking Ahead: Regulatory and Industry Response

The EPA and FBI joint advisory signals a new level of federal urgency around OT cybersecurity in the water sector. The EPA has previously issued enforcement alerts requiring cybersecurity risk assessments for water systems, and the current campaign will likely accelerate regulatory mandates. For industrial automation professionals, the message is clear: PLC security is no longer optional, and internet exposure of industrial controllers represents an unacceptable — and actively exploited — risk.

Rockwell Automation has issued customer guidance urging operators to disconnect affected devices from the public internet and has published best practices for OT firewall management, including application-aware filtering, policy lifecycle management, and regular rule set reviews. The company's Stratix industrial firewall portfolio, along with third-party solutions from Palo Alto Networks, Fortinet, and Cisco, provides the technical controls needed to implement the segmentation and access control measures recommended by federal agencies.

For the broader industrial automation community, this campaign serves as a defining moment — one that separates organizations that treat cybersecurity as a compliance checkbox from those that recognize it as a fundamental operational requirement.