CISA to Water Utilities: Disconnect Internet-Exposed PLCs Now After Coordinated Attacks

Detail

The attacks, which unfolded between July 26 and July 27, targeted operational technology (OT) environments responsible for automating essential water-treatment functions: pump switching, tank filling, chemical dosing, and emergency response. In several municipalities, operators were locked out of their own systems after threat actors remotely changed IP addresses and set new passwords on internet-facing PLCs. The result was a cascading loss of visibility and, in the worst cases, functional control over connected equipment.

This is not a fringe escalation. The Minnesota attacks represent the most concentrated OT disruption in the U.S. water sector on record. The fact that attackers specifically targeted Rockwell Automation / Allen-Bradley MicroLogix 1100 and 1400 series PLCs , legacy workhorses deployed in thousands of small and mid-sized utilities , suggests a deliberate, intelligence-driven campaign, not opportunistic scanning. The weaponization of publicly documented vulnerabilities in these controllers, including unauthenticated stored cross-site scripting (CVE details published via ICSA-22-354-04), underscores a painful reality: known flaws in widely deployed OT hardware remain unpatched across broad swaths of the sector.

Minnesota IT Services (MNIT) activated statewide cybersecurity incident response capabilities on the morning of July 27 after multiple municipalities simultaneously reported disruptions to their water utility control systems. By the end of the weekend, at least four cities , Braham, Plymouth, South St. Paul, and Maple Plain , had publicly acknowledged operational impacts.

In Braham, the water plant went completely offline. City officials later confirmed the outage resulted from "a malicious cyber-attack of computerized operating systems by unknown actors." In Plymouth, a Minneapolis suburb of approximately 80,000 residents, IT staff disconnected cellular-connected equipment at two water towers and multiple lift stations to halt the attack and prevent retargeting. South St. Paul reported that contingency procedures allowed public works staff to maintain normal operations manually, but automated controls were disrupted. Across the state, the affected systems shared a common vulnerability: PLCs directly accessible from the public internet, often through cellular modems installed by operators, vendors, or system integrators that had never been documented in routine attack-surface scans.

Loss of water pressure in multiple systems, creating risk of untreated groundwater seepage into distribution pipes.

Localized flooding where PLC-controlled valves and pumps failed in open or closed positions.

Modified PLC project files with unexplained ladder logic discrepancies identified across several sites.