CISA: Over 100 internet-exposed water systems targeted in July attacks

What happened

CISA observed malicious cyber activity targeting more than 100 internet-exposed systems in the water and wastewater sector during July 2026, SecurityWeek reported on August 26. A typical example of the exposed equipment: programmable logic controllers (PLCs) connected directly to cellular modems, which leaves them reachable from the public internet without traffic ever passing through a utility's corporate network.

SecurityWeek also reported that the activity has been linked to Iran-affiliated threat actors. Public reporting does not disclose the specific credentials, vulnerabilities, protocols or commands used in the attacks, so the exact tactics remain unknown.

Despite the scale of the targeting, no critical operational disruptions have been confirmed. There are no reports of widespread outages or water quality effects, and it is unclear whether attackers actually authenticated to or manipulated any of the targeted systems.

Why cellular connections create blind spots

The core problem is direct reachability. When a PLC attaches straight to a cellular modem, connections to it bypass corporate firewalls, proxies and SIEM pipelines, so both the attack traffic and often the asset itself are invisible to standard monitoring. Depending on NAT and telecom provider configurations, an exposed controller may not appear in the organisation's own asset inventory at all.

Where logging does exist, administrators can expect to see incoming connections, login attempts, and configuration or logic changes directed at PLCs from internet or cellular sources. Without logs from the modems, the devices or dedicated OT sensors, those contacts cannot be identified.

What CISA recommends

CISA's guidance centres on removing unnecessary exposure rather than hardening whatever stays online:

• Verify externally reachable assets by combining internal inventories with external attack surface scans, since cellular-connected devices are often missing from CMDBs.
• Eliminate direct internet exposure and consolidate necessary remote access behind secure gateways, jump hosts or VPNs.
• Change default passwords, apply security updates, enforce multi-factor authentication, and use allowlisting and least privilege.
• Continuously monitor OT network traffic.

How to investigate a potential contact

The practical indicators are external connections to PLC management ports and industrial protocol ports, failed and successful logins, configuration or logic downloads, and unusual commands. Because PLCs do not run endpoint agents, supporting evidence has to come from engineering workstations, HMIs and jump hosts — remote tools, configuration transfers, credential usage — as well as identity and VPN logs and audit logs from cellular modem management portals.

Investigators should separate three very different situations: scans or contact attempts, confirmed unauthorised logins, and confirmed logic or configuration changes with physical process impact. The "over 100 systems targeted" figure describes attempts, not confirmed compromises.

Why it matters

The incident underlines that in operational technology environments, exposure itself is often the vulnerability. The systems were attacked not because of a disclosed novel exploit but because they were reachable — and that same reachability hid them from the firewalls and monitoring utilities already operate. The gap between the number of systems targeted and the number confirmed compromised is also instructive: attackers appear to routinely discover exposed devices, so anything left online is likely to be found eventually. CISA's message is correspondingly blunt — inventory what is exposed, remove what does not need to be reachable, and put everything else behind authenticated gateways.