For months, reports of attacks on U.S. water and wastewater utilities have trickled out state by state, agency by agency, without a clear national picture of scale. That changed this week: CISA confirmed it observed malicious cyber activity targeting more than 100 internet-exposed systems in the Water and Wastewater Systems (WWS) Sector during July 2026 alone, most commonly through programmable logic controllers (PLCs) connected directly to a cellular modem.
It's the first time a federal agency has publicly quantified the scope of this particular wave of attacks—here's the full alert—and the number is large enough to move this from "isolated incident" to "sector-wide pattern."
CISA has not disclosed the full list of affected states, but confirmed targeting has been reported in at least 12, including Minnesota, Michigan, South Dakota, Georgia, New Jersey, and Alabama. The agency says none of the attacks caused significant disruption to date, but it released new guidance alongside the advisory specifically aimed at helping utilities reduce their internet exposure before that changes. In late July, 30 Minnesota community water systems were attacked.
The attacks CISA describes follow a pattern that's become familiar to anyone who has watched OT security incidents unfold over the past few years: PLCs—the small industrial controllers that manage pumps, valves, and treatment processes—connected directly to a cellular modem and left reachable from the public internet, often with default or weak credentials. It's a low-effort, high-availability target: no need for a sophisticated intrusion chain when the front door was left open.
Christopher Hills, Chief Security Strategist at BeyondTrust, drew a direct line to a prior, well-documented incident: "We have seen this same type of attack with the Aliquippa Water Plant, where threat actors targeted the PLC that was broadcasting Modbus (Port 502) on the public internet." From there, he explained, attackers "pivoted to the Human Machine Interface (HMI) which had default credentials that were never changed," using that access to install a web shell, deface the HMI screen, and attempt to disrupt pump operations and water pressure.
Louis Eichenbaum, Federal CTO at ColorTokens, put the underlying problem plainly: these OT systems "were never designed with cybersecurity in mind. They were built for reliability and availability, not to withstand modern nation-state cyber threats," he said. The result, in his assessment, is an environment across the sector that remains "internet-facing, poorly segmented, and inadequately monitored."
For the average resident, the reassuring headline is also the most important one: CISA reports no significant disruption to water service from this wave of attacks. That matters, and it's worth taking at face value; these were largely reconnaissance-and-access attempts, not successful sabotage of treatment processes.
But several of the experts we heard from cautioned against reading "no disruption yet" as "no real risk." David Brumley, Chief AI and Science Officer at Bugcrowd, noted that water utilities are attractive targets precisely because "they don't have the right resources," which makes them "both more vulnerable and slower to respond to successful hacks."
He added a sobering point about motive: many of these intrusions "start out simply to score political points," with adversaries like Iran seeking to embarrass the U.S., but "the scary part is what happens afterward, where an attacker may end up inside critical infrastructure." An attack that begins as digital graffiti doesn't have to stay that way once an adversary has a foothold.
John Gallagher, Vice President at Viakoo, framed these incidents as something closer to reconnaissance-by-force: "Malicious hackers and nation-state adversaries will often run live stress-tests against operators of critical infrastructure to test their defenses," Gallagher said. He was blunt about what that means going forward: these should be read as "warning shots" that "need to be taken seriously," even if, as he noted, successful attacks on any single small or rural utility don't translate into a broad public threat given how distributed and heterogeneous water infrastructure is across the U.S. and UK.
This incident is a case study in a problem OT security professionals have been raising for years: the assumptions that made industrial control systems reliable for decades are the same assumptions that make them exposed today. Matt Hartman, Chief Strategy Officer at Merlin Group, summarized the core issue, saying "Water utilities often rely on operational technology that was never designed to be directly exposed to the internet, while attackers are also looking for weaknesses across the vendors that support these environments." He called it "a systemic risk, not a series of isolated incidents."
Dana Simberkoff, Chief Risk, Privacy, and Information Security Officer at AvePoint, connected the current wave to a longer-standing set of structural weaknesses: "internet-facing controllers, weak segmentation, legacy systems, third-party access, and limited visibility into operational technology."
She also flagged a factor that's increasingly unavoidable in any 2026 OT security conversation: AI. "AI expands existing attack paths by helping adversaries identify exposed assets, generate exploit code, chain vulnerabilities, and operate at greater speed and scale," Simberkof said, while cautioning that "AI increases the urgency, but the vulnerabilities were already there." In other words: AI isn't creating these weaknesses, it's making them faster and cheaper to find and exploit at scale.
Hills made a related point about why OT is structurally harder to defend than IT: in most IT environments, "you have additional layers of security that typically help layer some of this access" beyond basic credential hygiene. OT, by contrast, "does not have these additional security layers to help protect them and is therefore vulnerable right from the start." That's precisely why, as Hills noted, NIST has stood up a dedicated project team to address critical infrastructure and OT specifically: the sector's risk profile doesn't map cleanly onto standard IT security assumptions.
Eichenbaum argued that the sector needs to shift its posture accordingly: "We are never going to patch fast enough or prevent every intrusion. The focus now must be on resilience"—assuming an adversary may get in, and architecting environments so that access doesn't translate into "the ability to move laterally or manipulate critical operations at scale." That's the core logic behind Zero Trust microsegmentation for OT: not preventing every intrusion, but shrinking what any single intrusion can reach.
CISA's response to this specific wave centers on a short, unglamorous list of fixes, and nearly every expert we heard from converged on the same basics, which is itself notable. Hartman laid out CISA's core guidance directly: "Identify internet-exposed assets, remove unnecessary exposure, change default credentials, patch supported systems, secure required remote access with controls like MFA, and continuously monitor for anomalous activity."
Simberkoff added operational specifics for utilities working through that list: enforce least-privilege access, monitor changes to controller logic specifically (not just network perimeter activity), maintain offline configuration backups so a compromised controller can be restored without depending on the compromised network, and build incident response plans that explicitly account for physical operations—not just IT systems.
Hills was direct about where the fastest wins are: default credentials. "Ensuring they are either turned off, managed, or at a minimum, rotated from their default/shipped state" is, in his words, foundational security that "does not need modern security" investment to implement; it needs discipline and follow-through, which he noted is where "many organizations, including IT, tend to forget about the basics." For municipal water districts, many of which operate with lean IT staff and legacy equipment that predates modern credential management practices entirely, that's a meaningful distinction: this isn't a call for a large capital investment, it's a call to finish work that should have been done at deployment.
Beyond immediate hygiene, several experts pointed toward a longer-term architectural shift. Eichenbaum and Hills both pointed to Zero Trust and microsegmentation as the right direction for OT specifically—creating security boundaries around systems that were never built to defend themselves, rather than trying to retrofit those systems with controls they can't support. Simberkoff also raised a regulatory dimension worth watching: frameworks like the EU's DORA and NIS2 are pushing cybersecurity "from an organization-centric model to an ecosystem and supply chain model"—a shift that's increasingly relevant for U.S. utilities too, as critical infrastructure operators grow more dependent on cloud providers, third-party AI tools, and software vendors whose security posture they don't directly control.
Nothing about this advisory describes a novel attack technique. Internet-exposed PLCs, default credentials, and weak segmentation are problems the OT security community has been documenting since long before this July's wave of attacks.
What's new is the scale CISA is now willing to put a number on, and the tone of urgency that comes with it. As Gallagher put it, the volume and velocity of these attacks means "passive advisory memos and slow cyber hygiene methods just won't work anymore"—and the gap between adversaries who move at the speed of an automated scan and utilities that move at the speed of "bureaucratic budget cycles and multi-year legislative processes" is exactly the gap these 100-plus incidents were able to exploit.