U.S. Water Utility Attacks Expose 4,407 Internet-Facing PLCs Nationwide

Why This Matters Now

In late July 2026, a coordinated cyber campaign struck more than 30 community water systems across Minnesota in a single weekend. Within days, the FBI confirmed incidents in at least seven states—and subsequent reporting has pushed that number to 12. The attack vector was not a sophisticated zero-day exploit. It was something far more fundamental: thousands of programmable logic controllers (PLCs) sitting on the public internet, accepting unauthenticated commands on a well-known industrial protocol port.

The message from federal agencies has been unambiguous. "Disconnect the PLC from the internet," CISA urged in its July 30 alert. "Remote access for operational purposes should go through a VPN or gateway device, not directly to the PLC." For roughly 50,000 small water utilities across the United States—most without dedicated cybersecurity staff—that guidance is easier issued than executed.

The Scale of Exposure: 4,407 Controllers and Counting

Forescout Vedere Labs researchers queried the Shodan search engine for devices exposing port 44818 and identified 4,407 Allen-Bradley controllers accessible worldwide. Sixty-five percent—approximately 2,865 units—are located in the United States. These are not devices hidden behind layers of network segmentation; they are directly reachable from any internet connection.

The 47% decline from the March 2020 peak signals progress, but in critical infrastructure terms, the remaining exposure remains catastrophic. As one Forescout researcher noted, utilities "cannot secure what they cannot see"—and asset discovery remains the single greatest blind spot for small and mid-sized operators.

Attack Mechanics: How the Intrusions Unfolded

The FBI and EPA joint Public Service Announcement, issued July 30, 2026, detailed the specific Tactics, Techniques, and Procedures (TTPs) observed across victim organizations. After gaining remote access to internet-facing PLCs, threat actors systematically:

• Changed device IP addresses to disconnect controllers from supervisory systems
• Set new passwords, locking out legitimate operators
• Modified PLC project files, introducing ladder logic discrepancies across multiple sites
• Caused physical consequences including pressure loss and flooding at affected facilities

Several utilities were forced to revert to manual operation—a fallback mode that is labor-intensive, imprecise, and unsustainable for extended periods. Boil water notices were issued in multiple jurisdictions.

The Attribution Puzzle

No formal attribution has been made for the July 2026 water utility attacks. However, the activity coincides with Joint Cybersecurity Advisory AA26-097A—issued April 7 and revised July 22 with the U.S. Treasury Department added as a co-author—which documented an Iranian-affiliated operational technology campaign targeting PLCs across government services, water systems, and energy infrastructure since at least March 2026.

LevelBlue's threat intelligence team noted that the MicroLogix 1100 and 1400 models represent a shift in targeted hardware from the CompactLogix and Micro850 families documented in the April advisory, suggesting either an expansion in targeting, a separate actor, or broader opportunistic scanning.

Federal Response and the Resource Gap

The joint FBI-EPA advisory outlined core mitigations: disconnect PLCs from the public internet, use complex unique passwords, implement IP allowlisting, and mediate all remote access through VPNs or secure gateways. CISA reinforced these measures with its own alert on the same day.

For large municipal systems with in-house OT security teams, these are achievable directives. For the roughly 50,000 small water utilities across the United States, the gap between prescription and execution is vast. Most operate with no cybersecurity personnel, aging hardware, and limited capital budgets.

The Franklin initiative represents one of the most creative responses to the critical infrastructure cybersecurity deficit, but the program's founder has been explicit: the U.S. government should eventually step in and fund sophisticated tools deployable at every water utility. Until then, the model remains a volunteer fire department confronting a five-alarm blaze.

Beyond Port 44818: The Broader OT Exposure Landscape

While the immediate crisis centers on EtherNet/IP and Rockwell controllers, the underlying problem is systemic. Forescout's 2026H1 Threat Review documented a 51% year-over-year increase in new vulnerabilities, surging ransomware activity, and continued targeting of specialized devices—PLCs, HMIs, automatic tank gauges, and cellular remote-access gateways that bridge IT and OT environments.

The July attacks also highlighted a recurring pattern: compromised cellular modems serving as the internet gateway to otherwise isolated control networks. In several cases, attackers did not breach a corporate firewall; they simply connected through an unsecured cellular modem with default credentials, gaining direct access to the PLC on the other side.

What Comes Next

The EPA has signaled that cybersecurity assessments may become part of sanitary survey inspections, and industry associations including the AWWA are accelerating guidance for small-system operators. But regulation moves slowly, and threat actors move fast. The immediate priority for any utility operator reading this is a single, no-cost action: verify whether your PLCs, HMIs, or SCADA servers respond on a public IP address. If they do, remove them. The next attack campaign is not a question of if—it is a question of when, and whether your devices are still visible when the scanning begins.