PLC Cyberattacks on US Water Utilities: 7 States Affected in July 2026

Detail

reported in six additional states, this incident represents the most geographically dispersed assault on US critical infrastructure this year. For industrial automation professionals and plant managers, the message is unequivocal: internet-exposed controllers are no longer a theoretical risk; they are an active battlefield.

Beginning in late July 2026, threat actors linked to Iranian advanced persistent threat (APT) groups executed a synchronized campaign against municipal water systems. The attackers systematically scanned for internet-exposed PLCs, then altered device IP addresses and authentication credentials to lock legitimate operators out of their own supervisory control systems.

The operational impact was immediate and severe. Multiple facilities lost real-time monitoring and remote control of water treatment processes, forcing a reversion to manual operations. Several municipalities issued boil water notices as a precautionary measure, though no contamination events have been confirmed. Crucially, no data exfiltration was detected, the objective appeared to be pure disruption, not espionage.

This incident diverges sharply from previous OT intrusions in three critical ways. First, the geographic spread across seven states points to a coordinated, intelligence-driven operation rather than opportunistic targeting. Second, the attack's simplicity, changing IP addresses and passwords, demonstrates that even unsophisticated techniques can cripple critical infrastructure when basic cyber hygiene is absent. Third, the deliberate lockout of operators signals an intent to maximize operational disruption rather than stealth. For the global automation sector, this is a watershed moment: PLC security can no longer be an afterthought.

controllers. These legacy and entry-level PLCs remain ubiquitous across North American water utilities due to their reliability, cost-effectiveness, and long service life. However, many units were deployed before modern cybersecurity standards became standard practice in OT environments.

The attack vector was straightforward: internet-facing PLCs with default or weak credentials, accessible via unsecured network configurations. Once inside, attackers reconfigured device network settings and changed passwords, effectively severing the link between the physical process and the human operator. No zero-day exploits or advanced malware were required, only open ports and poor access controls.

Minnesota (30+ confirmed facilities), plus six additional states (specific names withheld pending ongoing investigations)