The FBI and the U.S. Environmental Protection Agency have warned critical infrastructure operators in the water and wastewater sector about cyberattacks targeting operational technology.
The warning focuses on internet-exposed OT equipment, especially programmable logic controllers, or PLCs. Public advisories have specifically referenced Rockwell Automation and Allen-Bradley PLCs, including MicroLogix devices, as part of a broader campaign against internet-connected industrial control equipment.
A PLC is an industrial control device.
It monitors or controls physical equipment such as pumps, valves, motors, sensors, water-level systems and pressure-control equipment. If an ordinary IT server processes data, a PLC moves the physical world. When a PLC is compromised, the result may not be only data loss. It can become an operating failure.
According to public reporting on the federal warning, water and wastewater utilities in at least seven U.S. states reported incidents in late July 2026. The attackers accessed internet-exposed equipment remotely, changed IP addresses and passwords, and caused operators to lose monitoring or control functions. Some reported operational effects included pressure loss and flooding.
Pressure loss is not a minor inconvenience.
In water distribution systems, pressure helps prevent untreated groundwater or contaminants from entering the pipes. If pressure drops, water quality and public health can be affected. Flooding can also damage equipment, create electrical hazards and disrupt facility operations.
The meaning of the warning is clear.
Water and wastewater systems are places where a digital attack can become a physical failure.
Why PLCs Became Dangerous Targets
PLCs were not originally designed to sit directly on the public internet.
Industrial control devices were often built for closed operational environments inside plants, pump stations and field facilities. Over time, remote access became more common. Utilities needed remote maintenance, unmanned facility management, vendor support and lower operating costs. Cellular modems, VPNs, remote desktops, web interfaces, port forwarding and firewall exceptions were added.
The problem begins when control devices become directly reachable from the internet.
Attackers can scan the internet for exposed PLCs. If default passwords, weak passwords or reused credentials remain in place, access can be easy. If unauthenticated endpoints, outdated firmware or end-of-life equipment are present, the risk becomes higher.
The attack described by U.S. authorities does not appear to depend only on advanced zero-day exploitation.
In many cases, the core tactic was simpler: access exposed PLCs, change settings, alter IP addresses or passwords, and lock operators out. That alone can be enough to disrupt monitoring and control.
The goal is to make the operator lose control of their own equipment.
A PLC may look like a small device. But its impact depends on what it controls. If it only supports monitoring, the utility may lose visibility. If it controls pumps or valves, the effect can reach pressure, flow, water levels or drainage.
In OT security, one device is not merely one device.
It is a control point in a physical system.
Why U.S. Water Infrastructure Was Exposed
Water and wastewater facilities have long been seen as vulnerable in cybersecurity.
Unlike major power-grid assets or military facilities, many water systems are operated by local governments, small public agencies or regional utilities. Budgets may be limited. Cybersecurity staff may be scarce. Equipment is often used for many years. Operators may have deep experience in physical operations but limited dedicated cybersecurity resources.
Water systems must also run continuously.
It can be difficult to shut down systems for patching, replacement or redesign. Old PLCs, human-machine interfaces, modems and workstations remain in service. Remote maintenance is convenient, but if poorly designed, it becomes an attack path.
Federal reporting also indicated that some affected organizations had similar network configurations provided by third parties. That suggests a weak network or hardware setup may have been repeated across multiple utility customers.
This point is important.
A security problem may not be limited to one facility’s mistake. If the same equipment, remote-access method, configuration template or maintenance vendor is used across multiple sites, attackers can repeat one successful method across many targets.
In OT security, vendor and maintenance-provider configuration becomes a supply-chain risk.
One bad field setup can become a repeated weakness across an entire sector.
Removing Internet Exposure Is the First Response
The first recommendation from federal agencies is simple and powerful:
remove PLCs and other OT systems from the public internet.
OT systems should not be directly exposed to the internet or external networks. Access should be mediated, monitored and controlled through secure gateways or jump hosts. Inbound port exposure should be eliminated.
This is not new advice.
But it remains the most important advice.
Many organizations expose PLCs or modems for convenience. Operators can access equipment quickly. External maintenance vendors can troubleshoot faster. But the same openness also gives attackers a path.
Secure remote access is not direct exposure.
It requires layered controls:
security gateways;
strong authentication;
access-control lists;
VPN or zero-trust network access;
logging;
session monitoring;
and firewall rules that allow only authorized device-to-device communication.
In OT, the mindset must change.
The question is not “Can we connect to manage it?”
The question is “What happens if someone else connects?”
Convenience can become the enemy of safety.
Cellular Modems Are Hidden Doors
The FBI and EPA also emphasized cellular modem security.
Water utilities often use cellular modems to connect remote field sites. Pump stations, reservoirs, drainage systems and control panels may be far from wired infrastructure. Cellular connectivity can be practical and cost-effective.
But a cellular modem can become a hidden door.
Operators may focus on the main network firewall while forgetting that a field modem creates a separate external access path. If authentication is weak, logs are disabled or firmware is outdated, attackers can use that path.
Federal guidance recommends strong authentication, updates, logging and regular review of suspicious activity on cellular modem infrastructure. It also encourages more isolated architectures such as private APNs, private 5G networks, cellular SD-WAN, zero-trust access and site-to-site VPNs where appropriate.
The principle is clear.
Remote connectivity may be necessary.
But remote connectivity must not mean direct public exposure.
In OT security, one of the most dangerous connections is the one the administrator has forgotten.
Passwords Still Matter
Even in an era of advanced cyber threats, passwords still matter.
Federal guidance urges operators to set complex and unique passwords on PLCs and related equipment. This may sound basic. But in real field environments, default passwords, shared passwords, old passwords and reused credentials still exist.
OT devices often retain simple credentials for maintenance convenience.
Attackers know this.
If a PLC is exposed to the internet and protected by a weak password, the attack does not need to be sophisticated. An attacker can log in, change device settings, change the password and lock operators out. If the IP address is changed, connectivity to the device may be lost.
Passwords are an old security control.
But in OT, they remain a real line of defense.
They are not sufficient by themselves. They must be combined with network access control, device-specific accounts, logging, physical key switches, verified backups and manual operating capability.
But without strong passwords, every other control becomes harder to defend.
Why Run Mode and Physical Control Matter
Federal guidance also recommends using physical or software key switches to place PLCs in run mode when changes are not required.
This helps prevent unauthorized changes.
When a PLC is in program mode or remote mode, logic, settings or firmware may be modified. Such modes should be used only when updates or online downloads are necessary. After the work is complete, the device should be returned to run mode.
This shows the difference between IT security and OT security.
IT security focuses heavily on accounts and networks. OT security adds physical state and device operating mode. The position of a switch, the correctness of a ladder-logic project file and the integrity of downloaded control logic all matter.
Authorities also recommend reviewing and validating project files before switching devices back into run mode. Once the mode changes, the project currently on the device may be locked in place.
That means recovery after a PLC incident is not simply a matter of turning equipment back on.
The logic must be checked.
Backups must be verified.
Connected devices such as HMIs, modems and workstations must be inspected.
If there are signs of lateral movement, reimaging may be required.
In OT incident response, verification must come before restoration.
Manual Operation Is the Lifeline
Federal guidance also emphasizes the need to maintain manual operating capability.
This is critical.
If a digital control system fails or becomes locked, the physical facility must still operate. Operators may need to manually open valves, start or stop pumps, check local instrumentation and run bypass procedures. Without manual operating capability, a cyber incident can immediately become an operational shutdown.
Business continuity plans, disaster recovery plans, fail-safe mechanisms, islanding capability, software backups and standby systems must be tested regularly.
Documents are not enough.
People must be able to perform the procedure.
Shift teams must know what to do.
Equipment must actually work.
Backups must be current.
Manual switchover time must be measured.
The impact of the recent attacks depended partly on whether the affected PLCs monitored systems or controlled them, what facilities they supported and whether utilities could move to manual operation.
The final line of defense in OT security is still human field capability.
Full automation is convenient.
Automation without manual recovery is dangerous.
End-of-Life Equipment Is an Attacker’s Friend
The FBI and EPA also recommend planning for the replacement of end-of-life equipment.
End-of-life equipment is no longer actively sold or supported by the manufacturer. Security patches and software updates may not be available. Attackers prefer this kind of equipment.
Water and wastewater facilities commonly run old devices.
Industrial equipment may be used for 10 or 20 years. Budget constraints delay replacement. If the equipment still works, it often remains in service.
But in cybersecurity, “still working” does not mean “still safe.”
Federal guidance recommends maintaining a rolling 12-month forecast of end-of-life systems, reviewed quarterly by owners and procurement teams. Systems should be tracked by product, owner, location and retirement date. They should be replaced or isolated. If replacement is delayed, compensating controls and a fixed retirement schedule should be established.
This is realistic guidance.
Not every device can be replaced immediately.
But what is not inventoried cannot be managed.
If replacement is delayed, isolation is necessary.
“Someday” is not a security plan.
OT security begins with asset management.
An organization that does not know which PLCs it owns, where they are, what firmware they run, who is responsible for them and when they must be replaced cannot defend them.
Attacks on Water Systems Are Public Health Risks
A cyberattack on a water or wastewater facility is not just an IT incident.
Water supply and wastewater treatment are basic conditions of urban life. People drink water, wash, run hospitals, operate schools and keep factories open. If wastewater treatment fails, environmental and sanitation problems can follow.
Pressure loss is especially sensitive.
Water pipes must maintain pressure to help keep contaminants out. If pressure drops, groundwater or polluted material may enter the system under certain conditions. That makes pressure loss a public-health concern, not merely an operational metric.
Flooding creates additional danger.
If pump or valve control fails, a facility or surrounding area can flood. This can damage equipment, create electrical risk, increase recovery costs and interrupt operations.
When a cyberattack becomes a physical incident, the affected party is not only the utility.
It is the public.
Water-sector OT security is therefore not simply enterprise cybersecurity.
It is public safety.
In the AI Era, Basic Security Still Fails First
Cybersecurity conversations today often focus on AI-enabled attacks, automated vulnerability discovery, sophisticated ransomware groups and zero-days.
The FBI and EPA warning points to a more basic reality.
Internet-exposed PLCs.
Weak passwords.
Open remote access.
Cellular modems without proper monitoring.
Missing access-control lists.
End-of-life equipment.
Insufficient manual operating capability.
These basic problems can still create real operational disruption.
The security industry must discuss new threats. But in critical infrastructure, old weaknesses often remain the most dangerous. Attackers look for the easiest path. A directly exposed control device is an easy path.
AI-era OT security still begins with fundamentals:
asset identification;
removal of internet exposure;
strong authentication;
access control;
log monitoring;
backup validation;
manual-operation training;
and end-of-life management.
Without these basics, even advanced detection tools have limits.
The Warning for Korean Water and Industrial Facilities
This warning is not only an American issue.
Korean water utilities, purification plants, reservoirs, pump stations, wastewater facilities, industrial wastewater plants, power facilities and manufacturing sites also use PLCs, HMIs, SCADA systems, remote modems and field control panels. Facilities are distributed. External maintenance vendors often need access. Some sites are unmanned.
The same risks exist.
Korean organizations should ask at least the following questions.
Are any PLCs directly exposed to the internet?
Do cellular modems or remote-maintenance devices create separate external paths?
Are default passwords or shared passwords still in use?
Do access-control lists and firewalls allow only authorized communication between control devices?
Are PLC project files and ladder-logic changes reviewed?
Are backup files verified as clean and correct?
Can field operators actually perform manual procedures?
Is there an inventory and replacement plan for end-of-life equipment?
Are external maintenance vendors repeating vulnerable network configurations across multiple sites?
Local governments and public facilities may be especially exposed because cybersecurity can be delayed by budget and staffing limits. But water systems are directly connected to citizen life. OT security for local water infrastructure may be one of the most realistic weak points in national critical infrastructure security.
Security is not only a problem for large institutions.
One small pump station can become the starting point of an incident.
To Protect Water, Remove PLCs From the Internet
The FBI and EPA warning is not just a technical advisory.
It is a warning that water and wastewater systems are experiencing real operational disruption from cyberattacks. Utilities in at least seven states reported incidents. Some saw degraded water operations. Attackers remotely accessed internet-exposed PLCs, changed IP addresses and passwords, and caused operators to lose monitoring and control. Reported impacts included pressure loss and flooding.
The lesson is clear.
PLCs should not be directly exposed to the internet.
Remote access should be mediated through secure gateways.
Passwords must be strong and unique.
Access-control lists and firewalls should allow only authorized communication.
Cellular modems must be treated as separate attack paths.
Project files and ladder logic must be verified.
Manual operating capability must be trained in practice.
End-of-life equipment must be replaced or isolated.
OT security is no longer an internal technical issue inside factories and utilities.
It protects the physical infrastructure of water, electricity, transportation, healthcare and manufacturing. An IT security incident may end in data exposure. An OT security incident can become pressure loss, flooding, treatment failure and citizen safety risk.
The FBI and EPA warning shows that, even in the AI era, security fundamentals remain decisive.
The first task is not complicated.
Remove control equipment from the internet.
The first defense for a water system is not the newest AI security solution.
It is eliminating exposed PLCs.
