CISA warns attackers are locking water utilities out of internet-exposed PLCs

On 30 July 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) published an alert reporting a marked increase in threat actors targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems sector. The attacks are not built around a novel software bug: according to CISA, attackers are simply reaching controllers that are already reachable from the public internet, then changing device passwords so operators cannot log in and altering IP addresses so the devices drop off the network. The agency says this activity has already produced boil water notices and forced utilities into extended manual operation.

What the alert says

CISA's core recommendation is blunt: infrastructure owners, operators and integrators should take publicly exposed PLCs and other operational technology (OT) off the internet as soon as possible. The agency notes the targeting affects water entities of every size, and that even organisations with mature cybersecurity programmes should re-validate their external connections.

One detail stands out. CISA specifically warns about cellular modems installed by operators, vendors or system integrators that may never have been documented and therefore never appear in routine attack surface scans. In practice, the exposure that gets an operator locked out may not exist in the inventory the organisation believes it maintains.

The agency frames the risk in operational rather than purely technical terms: internet-facing OT carries elevated risk of defacement, configuration changes, operational disruption and, in severe cases, physical damage.

Recommended mitigations

The mitigations CISA lists target the root cause, direct reachability, rather than a specific vulnerability:

• Disconnect PLCs from the internet entirely. Remote access for operational work should pass through a VPN or gateway device rather than terminating on the controller itself.
• Enable password protection on devices and replace default credentials.
• Allowlist source IPs so that only recognised engineering laptops or other approved OT assets can connect remotely.
• Once a PLC is taken offline, keep a known clean backup of its image so that a maliciously changed password does not leave the operator choosing between permanent lockout and unsafe recovery.

The alert also directs owners of Rockwell Automation MicroLogix 1400 controllers to the vendor's procedure for regaining access when the password is unknown, and points to UK National Cyber Security Centre guidance on secure OT connectivity as well as an FBI advisory on actors targeting internet-facing PLCs in the water and wastewater sector.

The size of the exposed surface

A dev.to analysis of the alert attempted to quantify how much industrial equipment is actually reachable. Queries run in the ZoomEye internet-wide search engine on 15 September 2026 found 41,601 hosts answering on TCP port 44818 with the EtherNet/IP service common in Rockwell environments, and 37,792 hosts speaking Modbus on port 502. Queries narrowed to the United States returned between roughly 4,700 and 5,100 assets depending on the filter used.

The dev.to write-up is careful about what these figures mean. They measure exposure, not compromise: both protocols are legitimate and widely deployed, and no count establishes that a given asset belongs to a water utility or has been attacked. Notably, a fingerprint query for the specific MicroLogix 1400 model returned zero results while a broader Rockwell Automation fingerprint returned 86, a reminder that protocol-level queries give a more reliable picture of reachable industrial surface than product-name fingerprints.

Why it matters

This story is about reachability, not a patchable CVE. CISA is reporting active targeting of exactly the class of exposure that tens of thousands of internet-facing industrial endpoints represent, and the documented consequences, boil water notices and sustained manual operation, are operational and public rather than theoretical. The fixes are architectural and comparatively cheap, but they only work if defenders can see the full picture, including undocumented cellular modems and vendor-installed remote access links. For any organisation running OT, the actionable question is whether it can account for every external connection it owns. If it cannot, that gap is the risk.