The breach of more than 100 internet-exposed water and wastewater systems across at least seven U.S. states is no longer a narrow operational technology story. A new whitepaper covered by SecurityBrief Asia draws a direct line between those intrusions and the cyber risk now facing telecommunications and other critical network infrastructure. The reason is structural, not coincidental: the same classes of PLC security failure — outdated firmware, exposed administrative interfaces and public-facing software with known vulnerabilities — sit inside telecom backbone and edge environments too. For asset owners and procurement teams, the window to treat programmable logic controllers as first-tier national infrastructure assets is closing.
What CISA Confirmed About the Water Sector Campaign
Federal agencies confirmed that hackers breached more than 100 internet-exposed water and wastewater systems across at least seven U.S. states, including Michigan and Minnesota. The campaign has been widely attributed to Iran-linked actors, with the IRGC-affiliated cluster tracked as CyberAv3ngers among the most frequently referenced. Notably, officials have stopped short of formal attribution in several of the most recent incidents, leaving operators to defend against behaviour rather than a named adversary.
Targeting patterns have broadened sharply. What began as exploitation of Rockwell Automation/Allen-Bradley controllers — specifically MicroLogix 1100 and 1400 series devices — expanded through 2026 to include observed activity against Schneider Electric and Siemens PLCs. That widening scope matters because it invalidates the assumption that defenders can simply harden one vendor family and consider the job done.
Timeline: how the PLC targeting campaign escalated
| Period |
Development |
| April 2026 |
Joint advisory (AA26-097A) discloses active exploitation of internet-exposed Rockwell Automation/Allen-Bradley PLCs by an Iranian-affiliated group, linked to prior Unitronics PLC compromises in U.S. water utilities. |
| July 22, 2026 |
Advisory updated: scope expands to Schneider Electric, Siemens and potentially other branded PLCs. Actors observed downloading malicious project files via vendor configuration software. |
| July 26–27, 2026 |
Coordinated incidents hit more than 30 community water utilities across Minnesota. |
| July 27, 2026 onward |
FBI and EPA issue a public service announcement noting water and wastewater utilities in at least seven states reported incidents, some degrading water operations. |
| July 30, 2026 |
CISA warns of a significant increase in hacking activity targeting programmable logic controllers. |
| August 19, 2026 |
U.S. agencies warn that unidentified hackers are attempting to breach Siemens devices used to monitor and operate water and other critical infrastructure, using AI to shorten exploit development. |
Analyst Insight: The headline number understates the problem. Reported operational effects have included loss of pressure and flooding, and the FBI has noted that impact severity depends on whether the compromised controller was monitoring or actively controlling equipment — and on whether operators could switch to manual mode. In telecom, where remote sites are frequently unmanned, the fallback to manual intervention is far more limited. That asymmetry is precisely why a water-sector incident pattern is being read as a telecom warning.
Why Telecom Inherits the Same PLC and OT Exposure
The whitepaper argues the water-sector playbook is transferable because the underlying weaknesses are shared across sectors. Outdated firmware that never receives patches, administrative interfaces reachable from the public internet, and public-facing software carrying known vulnerabilities form the same attack surface in telecom cabinets, remote radio sites and edge compute enclosures as in a municipal pump house.
Telecom environments typically add variables that increase, rather than reduce, exposure. Distributed footprints make physical inspection rare, long service lifecycles mean legacy controllers can remain operational for a decade or more, and third-party maintenance access is often brokered through leased infrastructure — a tactic the advisory explicitly notes attackers themselves used.
Market Trend: The convergence of IT and OT security budgets is accelerating. Investors and procurement teams should expect asset inventories — an accurate list of every controller, its firmware revision and its network reachability — to become a prerequisite for insurance, regulatory compliance and vendor qualification, not an optional audit output.
AI Is Compressing the Attack Lifecycle
The most consequential technical detail in the reporting is the use of artificial intelligence to accelerate reconnaissance and auto-generate scripts aimed at specific Siemens PLC models. U.S. agencies have stated that AI is dramatically reducing both the technical expertise and the time required to develop working exploits against these devices.
This changes the economics of attack. Historically, targeting a specific controller model demanded specialist knowledge of vendor programming environments; that barrier now functions more as a speed bump than a gate. Defenders can no longer rely on attacker skill scarcity as an implicit control.
FAQ: What telecom and industrial operators are asking now
Are only Rockwell PLCs affected?
No. The initial advisory focused on Rockwell Automation/Allen-Bradley controllers, but updated guidance confirms observed targeting of Schneider Electric, Siemens and potentially other branded PLCs.
Is the campaign definitively attributed to a state actor?
Authorities have described the actors as Iranian-affiliated and linked the activity to IRGC-associated clusters. Some of the most recent incidents have not been formally attributed despite widespread expert suspicion, so defenders should prioritise behavioural detection over attribution-dependent controls.
Do air-gapped facilities still face risk?
Air gaps are frequently incomplete in practice. Temporary remote access for maintenance, vendor tunnels and unmanaged gateways routinely restore connectivity between OT devices and untrusted networks.
Does replacing hardware solve the problem?
Not on its own. Migration to newer controllers removes known vulnerabilities but reintroduces risk if commissioning leaves default credentials, exposed services or unrestricted inbound port access in place.
Mitigation Priorities for PLC and OT Security
Official guidance converges on a small number of high-impact actions. The clearest is removing inbound port exposure so that controllers are never directly reachable from the internet or external networks, with all remote access mediated through a brokered, monitored gateway or jump host.
Network-layer controls follow closely: firewall rules and access control lists restricted to expected control-system communications, with traffic from hosting-provider and threat-actor-controlled IP ranges blocked. Engineering practices matter equally — auditing reusable code modules and function blocks for unauthorised changes, and verifying PLC logic against known-good baselines, are now standard expectations rather than advanced measures.
Operational checklist: hardening exposed controllers
- Maintain a live inventory of every PLC, HMI and gateway, including firmware revision and internet reachability status.
- Eliminate inbound port exposure; broker all remote access through a monitored jump host or secure gateway.
- Apply firewall rules and access control lists permitting only authorised control-system device communications.
- Block inbound traffic from unauthorised and threat-actor-controlled IP addresses, including hosting-provider ranges.
- Audit reusable code modules and add-ons for tampering; compare running logic against documented baselines.
- Replace default credentials and disable unused services and protocols on all controllers.
- Confirm that a viable manual or fail-safe operating mode exists for every critical control function.
- Run tabletop incident response exercises with IT, OT and third-party maintenance providers.
The strategic takeaway is that PLC-level security has graduated from a niche operational technology concern to a top-tier infrastructure issue spanning water, energy and telecom alike. The attack surface is not new; what has changed is the pace, the automation behind it, and the breadth of vendors now in scope.
Analyst Insight: Expect a lifecycle shift in industrial automation procurement. Buyers will increasingly weigh vendor security disclosure practices, firmware update cadence and legacy support windows alongside controller specifications — and fleet-wide visibility will matter more than the performance of any single device.
