CISA reported attacks on 100+ internet-exposed water utility PLCs using default credentials

What happened

In July 2026, CISA reported malicious activity against more than 100 internet-exposed systems in the water and wastewater sector, according to a dev.to analysis of the agency's advisories. Most of the affected devices were programmable logic controllers attached directly to cellular modems. Incidents stretched across at least twelve US states, and several utilities confirmed compromises.

What stands out is the simplicity of the campaign. Nobody needed to develop an exploit. The attackers walked through doors left open: reachable controllers, factory-default or weak passwords, and a control layer that never had authentication designed into it.

How the attacks unfolded

The pattern was consistent across incidents, the dev.to write-up explains. Attackers scanned for controllers reachable from the public internet, logged in with default or weak credentials, then changed the administrator password so the legitimate operator could not sign back in, and altered the device IP address so normal communication stopped. In some cases the control logic itself was modified.

The immediate consequence was lost remote visibility. Operators could no longer see pump status, valve positions or pressure readings through their normal systems, and some utilities reverted to manual readings and hand-operated valves. The article reports physical effects including pressure loss and localized flooding.

A control layer without authentication

PLCs were engineered for availability and physical durability, not for hostile networks. Many models still in service offer no native encryption, no certificate validation and no multi-factor authentication. Industrial protocols such as Modbus and EtherNet/IP, commonly found listening on ports 502 and 44818, were specified for trusted local networks and carry no authentication of their own — anyone who can reach the controller can, by design, command it.

The internet exposure often traces back to a practical decision. Remote monitoring is genuinely useful, and the fastest route to it is attaching a cellular modem to the controller. When a contractor installs that modem and it never enters the asset register, the organisation may not know the path exists. CISA has warned that such undocumented cellular links sit outside perimeter visibility, because controls cannot watch a connection nobody recorded.

Exposure counts are not compromise counts

Public measurement data indicates that thousands of industrial protocol hosts are reachable from the internet, with a large share in the United States. The dev.to author is careful with this figure: it counts exposed services, not confirmed vulnerable or compromised devices. A controller answering on port 502 or 44818 is reachable; whether it accepts default credentials is a separate question the scans do not answer. Reading exposure numbers as a tally of victims would overstate the finding while still describing a serious problem.

Attribution is similarly unresolved. US authorities described those responsible only as malicious actors; some security vendors compared the activity to earlier campaigns against industrial control systems, and press coverage noted speculation about state-linked involvement, but no official attribution existed at the time of reporting.

Defensive priorities

The analysis lays out a practical checklist:

• Remove direct internet exposure. Route remote access through a VPN or an authenticated industrial gateway instead of mapping a cellular modem straight to the controller.
• Replace default credentials everywhere, including on devices considered internal, since the reported attacks succeeded on default or weak passwords.
• Segment networks so one compromised controller cannot become a foothold for lateral movement.
• Keep offline backups of controller logic and configuration; recovering a device whose password and program were changed can otherwise require a site visit.
• Audit undocumented connections, because an asset register that omits cellular modems cannot protect them.

Why it matters

This incident is what happens when a protocol generation that assumed trusted networks collides with ubiquitous internet connectivity. The attackers needed no zero-days, just reachability and unchanged defaults, which means the fix is largely configuration work rather than exotic security engineering. It is also a reminder that exposure scans and incident counts answer different questions, and reporting that conflates them distorts risk. Water utilities are the current case study, but the same unauthenticated control layer runs across manufacturing, energy and transport, and the same playbook — remove exposure, enforce credentials, segment, back up, inventory — applies everywhere it does.