Water utilities across the United States are racing to harden PLC cybersecurity after federal agencies warned that hackers have begun modifying programmable logic controller passwords, locking out operators, and severing connections to critical water infrastructure. The urgency reflects a broader global shift: U.S. utilities endured 1,162 cyberattacks in 2024, a nearly 70% jump from the prior year, according to industry research.
For municipalities that have long treated operational technology as an afterthought, the message is clear — the programmable logic controller is no longer just a component; it is the command layer of public safety.
The PLC: The Brain of Water Infrastructure
Inside every water treatment plant, lift station, and pump control room, programmable logic controllers orchestrate the physical world: opening valves, dosing chemicals, and cycling pumps. One official described the device simply as the brain of the system.
The market dominance is equally concentrated. In the same way that GE defined appliances or Microsoft defined desktop computing, Allen-Bradley has become the default name in PLC hardware — the GE, the Microsoft of programmable logic controllers, as one municipal official put it.
Analyst Insight
The water sector's reliance on a small number of PLC vendors — particularly Rockwell Automation's Allen-Bradley line — creates a concentrated attack surface. Threat actors who develop exploits against one widely deployed controller family can potentially reach thousands of facilities with a single technique.
How Attackers Are Locking Out Operators
The Cybersecurity and Infrastructure Security Agency (CISA) has issued repeated alerts describing a troubling new tactic: hackers are not just disrupting operations — they are changing the locks. Attackers have modified PLC passwords, locked out legitimate operators, and disconnected devices by altering their internet protocol (IP) addresses.
The attacks exploit a familiar weakness: internet-exposed controllers protected by default credentials or weak passwords. In one documented incident, threat actors accessed a Unitronics Vision Series PLC by exploiting the factory-default password 1111.
Technical data: Documented attack techniques against water PLCs
-
Password modification: Threat actors change PLC credentials to lock out authorized operators and block corrective action.
-
IP address changes: Attackers alter network settings to sever remote access and conceal the compromised device.
-
Default credential exploitation: Devices left on factory passwords, such as the Unitronics default 1111, remain a primary entry vector.
-
Internet exposure: PLCs and HMIs reachable directly from the public internet without segmentation or MFA are routinely discovered and targeted.
Market Trends
Ransomware attacks in the energy and utilities sector surged 80% year over year, with 84% of incidents beginning through phishing and 96% involving remote service exploitation, according to a 2025 Trustwave report. The water sector is now firmly inside the blast radius.
Why PLC Cybersecurity Matters Now
The stakes moved from theory to reality in rapid succession. A January 2024 incident in Muleshoe, Texas, saw a water tank overflow after attackers exploited default passwords on control systems. Months later, American Water — the largest regulated U.S. water utility, serving 14 million people across 14 states — detected a cyberattack that forced the company to disconnect customer portals and pause billing.
Britain's Drinking Water Inspectorate logged 15 cyberattack reports from water suppliers between January 2024 and October 2025, confirming the threat is not an American anomaly.
Market statistics: The escalating threat to utilities
-
1,162 cyberattacks against U.S. utilities in 2024 — up roughly 70% from 689 in 2023.
-
234% year-over-year jump in attacks by Q3 2024, averaging 1,339 weekly incidents (Check Point Research).
-
15 cyberattack reports from U.K. water suppliers between January 2024 and October 2025.
-
14 million customers served by American Water, which paused billing after its October 2024 breach.
The Municipal Hardening Playbook
In response, water and sewer departments are treating their operational technology as a security perimeter rather than an isolated control loop. Utilities are segmenting IT and OT networks, eliminating default credentials, and deploying multifactor authentication for remote access to controllers.
From set-and-forget to active defense
Federal guidance is converging on the same fundamentals. CISA's operational technology guidance emphasizes asset inventory, network segmentation, and continuous vulnerability scanning — a departure from the set-and-forget posture that defined the sector for decades.
FAQ: What utilities and integrators need to know
Why are water PLCs being targeted?
Programmable logic controllers are internet-accessible in many facilities, frequently run on default passwords, and directly control physical processes — making them a high-impact, low-effort target for hacktivists and nation-state actors.
What should operators do first?
Validate that no default passwords remain in use, segment OT networks from IT and the public internet, require multifactor authentication for remote access, and maintain a current asset inventory of every controller and HMI.
Are Allen-Bradley PLCs specifically at risk?
Yes. The FBI and EPA have warned that malicious actors are targeting Rockwell Automation/Allen-Bradley PLCs, including MicroLogix 1100 and 1400 series devices, in the water and wastewater sector.
Does this affect water safety?
Documented incidents have so far largely disrupted operations and billing rather than water quality, but the manipulation of control logic remains a core risk that regulators are moving to close.
Analyst Insight
Expect PLC security to become a procurement requirement, not an afterthought. As utilities modernize aging control systems, vendors and integrators that bake in secure-by-default configurations, audit logging, and firmware-update paths will hold a structural advantage in the next purchasing cycle.
The era in which a programmable logic controller could quietly run a water system for 20 years, untouched and unmonitored, is ending. Municipalities that treat PLC cybersecurity as a core operational function — not a compliance checkbox — will be the ones that keep their operators in control when the next intrusion attempt arrives.
