PLC Attacks on US Water Utilities: 3 Cyber Threats to Watch
On this page
PLC Attacks on US Water Utilities: 3 Cyber Threats to Watch
The summer of 2026 marked the moment industrial control systems stopped being a theoretical target. Between late July and August, Iran-linked threat groups breached Programmable Logic Controllers (PLCs) at water and wastewater utilities across the United States , not to steal data, but to seize control. Operators were locked out of their own systems, passwords no longer worked, and visibility into
Detail
The incidents were not isolated. At least 12 states reported operational impacts, according to analysis from Dark Reading, while federal alerts cited disruptions spanning Minnesota, New Jersey, and beyond. The campaigns disrupted operational technology (OT) systems and raised a fundamental question: can the world's critical infrastructure actually be secured?
The defining vulnerability was never exotic malware. It was internet-exposed PLCs running weak or default credentials , a configuration decision, not a zero-day exploit. That distinction matters enormously: the fix is architectural and procedural, not a vendor patch.
According to a joint advisory from the FBI, CISA, NSA, EPA, the Department of Energy, and U.S. Cyber Command, Iranian-affiliated advanced persistent threat (APT) actors accessed internet-facing PLCs using leased third-party infrastructure and legitimate manufacturer programming software.
Once inside, attackers did not simply observe. They modified device configurations , changing IP addresses and setting passwords , which produced a "loss of view," and in some cases a loss of function, over connected equipment. The result was boil-water notices, a retreat to manual operations, and reported incidents of pressure loss and flooding across several victims.
Some victims later discovered altered ladder logic and modified project files, indicating the intrusion went beyond disruption into persistent tampering. CyberAv3ngers , also tracked as Hydro Kitten, Shahid Kaveh Group, and Storm-0784 , has been linked to the activity, echoing its 2023 campaign that compromised at least 75 PLCs at U.S. water facilities using default credentials.
Joint federal advisory AA26-097A issued; later revised on July 22 to name Rockwell Automation/Allen-Bradley, Schneider Electric, and Siemens PLCs.
Water and Wastewater Sector attacks begin. The FBI and EPA issue a public service announcement on July 30.
Sourcing help
Send the BOM for one quote covering active stock, EOL stock and cross-references.
Need a quote for this part?
Send us the part number or article link — we will confirm price, availability and lead time.
